CVE-2026-94131
Acymailing: SQL injection
- Risk score
- 52/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.
- Affected
- Acymailing
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Acymailing: Yellow, plan it in. Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web…
The flaws
- CVE-2026-94131: SQL injection (CVSS 8.1 · EPSS 0%)
- CVE-2026-94132: Unrestricted file upload can lead to remote code execution (CVSS 8.1 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Acymailing
Where it stands
- No known exploitation
Connects to
- Same weakness: SQL injection (CWE-89). 399 other warnings in 30 days
Why it is Yellow
- CVSS 8.1 high
References
Original description
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.
Last activity 26 Sep 2026. Patch Forecast updates every hour.