iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE

What to do

1. Check every Joomla site for iCagenda and note both the iCagenda and Joomla versions.
2. Update iCagenda to 4.0.13 or later (Joomla 4-6) or 3.9.16 or later (Joomla 3), and update Joomla 6 sites to the latest Joomla 6 release.
3. On Joomla 6 sites that ran iCagenda 4.0.7 or earlier after June 15, inspect images/icagenda/frontend/attachments/ for PHP files and treat any as a web shell.
4. If a site was hit, preserve the suspicious files, remove them, change all Joomla passwords and secrets, and audit the whole site, not only the iCagenda folders.
5. If you cannot update right away, rename the com_icagenda component folders; unpublishing the component or its menu item does not block the submit endpoint.

How to check if you are affected or compromised

• Search access logs for the icagenda-batch/1.0 user agent and for requests to .php files under images/icagenda/frontend/attachments/.
• List files in images/icagenda/frontend/attachments/ and flag anything that is not an expected document or image.
• Check the iCagenda event queue for unapproved events you did not expect, which point to use of the guest-submission bypass.
• Look for new administrator accounts and recently modified PHP files elsewhere on the site.

What happened#

iCagenda is an events-calendar extension for Joomla, maintained by JoomliC. On June 15, 2026, automated attacks began hitting its frontend "Submit an Event" form. JoomliC dates them from 8 a.m. UTC that day. The form's file attachment feature kept whatever extension the visitor supplied and saved the file under the web root. A guest could upload a PHP file and then request it, which is remote code execution. A second flaw on the same path ignored the "Registered" access setting when processing submissions. That let anonymous visitors create unapproved events.

JoomliC shipped iCagenda 4.0.8 the same day, labeled "Critical Security release." 3.9.15 followed on June 16 for Joomla 3. mySites.guru spotted the attacks in a client's access log, reproduced the bug and reported it on June 15. The CVE record was published June 20 by the Joomla CNA, which scored it CVSS 4.0 10.0. CISA added it to the KEV catalog on July 10, with a federal deadline of July 13. The same KEV update added a similar Joomla extension bug, Balbooa Forms CVE-2026-56291, per The Hacker News.

Who is affected#

The CVE covers iCagenda 3.2.1 through 4.0.7 (see also NVD). The dangerous half is narrower. JoomliC's advisory scopes the critical vulnerability to Joomla 6.0.0 through 6.1.1. It explains: "Unsafe file uploads were already blocked by default on all Joomla versions prior to Joomla 6." It adds that Joomla 6.1.2 reinstated that default blocking. In practice, the shell upload worked on Joomla 6 sites below 6.1.2 running iCagenda 4.0.x before 4.0.8. The guest event-creation bypass affected every Joomla version.

Two later vendor releases matter for "which version is safe." 4.0.12 (August 14) fixed an unauthenticated SQL injection in the calendar module, CVE-2026-67365, plus three lower-severity issues. 3.9.16 brought the applicable fixes to Joomla 3. 4.0.13 (August 18) fixed a stored XSS, CVE-2026-75948, that was a regression introduced in 4.0.8. Stopping at 4.0.8 is not enough.

Do you really need to act?#

• Joomla 6.0.0-6.1.1 with iCagenda 4.0.7 or earlier after June 15: the attacks were automated and began before a patch existed, so assume you were scanned. Updating does not remove a shell that is already there. Hunt.
• Joomla 3, 4 or 5 with an old iCagenda: core blocked the PHP upload, so the RCE did not fire. You may have junk unapproved events. Update for the guest bypass and the August SQL injection.
• No iCagenda: nothing to do here.

This is a Joomla extension bug, so most development teams will not have it anywhere. The realistic audience is agencies and organizations running event or community sites on Joomla.

What to do now#

1. Find the versions. For iCagenda: grep -h '<version>' administrator/components/com_icagenda/*.xml. For Joomla: grep -E 'MAJOR_VERSION|MINOR_VERSION|PATCH_VERSION' libraries/src/Version.php.
2. Update iCagenda to 4.0.13 or later on Joomla 4-6, or to 3.9.16 or later on Joomla 3. Bring Joomla 6 to its latest release (6.1.2 or later restores the core upload block).
3. If you cannot update today, rename the com_icagenda folders, as mySites.guru advises. Unpublishing the component or menu item does not close the endpoint. Reinstall from a clean download afterwards.
4. Check the attachments folder now: find images/icagenda/frontend/attachments -type f -iname '*.php*'.

How to tell if you were hit#

mySites.guru describes the attack sequence. A scanner with the user agent icagenda-batch/1.0 obtains a token, posts an upload to the submit endpoint, then fetches the planted file from images/icagenda/frontend/attachments/. Search logs with grep -E 'icagenda-batch|icagenda/frontend/attachments/.*\.php' access.log*. Treat any PHP file in that folder as a web shell until proven otherwise. Unexpected unapproved events in the queue show the access bypass was used. JoomliC's cleanup advice: keep copies of suspicious files as evidence, delete them, change Joomla passwords and credentials, and audit the entire site. Attackers often leave a second way in, such as new admin users or modified PHP files elsewhere. JoomliC also notes that a missing alert after updating does not prove the site is clean.

Timeline#

• Jun 15, 2026 — Automated attacks begin at 8 a.m. UTC. mySites.guru reports the bug, and JoomliC releases iCagenda 4.0.8.
• Jun 16, 2026 — iCagenda 3.9.15 is released for Joomla 3.
• Jun 20, 2026 — CVE-2026-48939 is published (CVSS 4.0 10.0).
• Jul 10, 2026 — CISA adds the CVE to KEV, with a federal deadline of July 13.
• Aug 14, 2026 — iCagenda 4.0.12 and 3.9.16 fix further bugs, including an unauthenticated SQL injection.
• Aug 18, 2026 — iCagenda 4.0.13 fixes a stored XSS regression introduced in 4.0.8.

Vulnerability records

• CVE-2026-48939 · KEV 2026-07-10 · A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. JoomliC — iCagenda Security Update (version 4.0.8) joomlic.com
2. iCagenda — Changelog 4.0.8 icagenda.com
3. iCagenda — Changelog 3.9.15 icagenda.com
4. JoomliC — iCagenda Security Update (version 4.0.12) joomlic.com
5. JoomliC — iCagenda Security Update (version 4.0.13) joomlic.com
6. CVE record — CVE-2026-48939 cve.org
7. NVD — CVE-2026-48939 nvd.nist.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-48939 cisa.gov
9. mySites.guru — iCagenda zero-day: file upload to RCE mysites.guru

Coverage and analysis

1. The Hacker News — iCagenda and Balbooa Forms Joomla flaws exploited thehackernews.com