---
title: "iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE"
url: https://erroneo.us/security/briefs/icagenda-joomla-cve-2026-48939-file-upload-rce/
description: "Unauthenticated PHP upload via iCagenda's Submit an Event form, exploited since June 15; RCE only on Joomla 6.0.0-6.1.1. Update to 4.0.13+ and hunt for shells."
type: security-brief
section: "Security Digest"
date_published: 2026-06-15
date_modified: 2026-08-18
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-48939"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# iCagenda CVE-2026-48939: Exploited Joomla Upload-to-RCE

**Verdict: Check exposure.** Only Joomla 6.0.0-6.1.1 sites running iCagenda before 4.0.8 were open to web shells; those sites need a web-shell hunt, while everyone else on iCagenda simply updates.

- **Who must act:** Owners of Joomla 6 sites (6.0.0 to 6.1.1) that ran iCagenda 4.0.7 or earlier at any point since June 15, 2026, and agencies managing fleets of Joomla sites.
- **Who can relax:** Sites that do not use iCagenda; Joomla 3, 4 and 5 sites, where core already blocked the malicious upload (update anyway for the guest-submission and later SQL injection fixes).
- **Affected:** iCagenda 3.2.1 through 4.0.7 (CVE range); Remote code execution: iCagenda before 4.0.8 on Joomla 6.0.0-6.1.1; Guest event creation without login: affected iCagenda on all Joomla versions
- **Fixed:** iCagenda 4.0.8 for Joomla 4-6 (4.0.13 or later recommended); iCagenda 3.9.15 for Joomla 3 (3.9.16 or later recommended); Joomla 6.1.2 restores core blocking of unsafe uploads
- **CVEs:** CVE-2026-48939
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check every Joomla site for iCagenda and note both the iCagenda and Joomla versions.
2. Update iCagenda to 4.0.13 or later (Joomla 4-6) or 3.9.16 or later (Joomla 3), and update Joomla 6 sites to the latest Joomla 6 release.
3. On Joomla 6 sites that ran iCagenda 4.0.7 or earlier after June 15, inspect images/icagenda/frontend/attachments/ for PHP files and treat any as a web shell.
4. If a site was hit, preserve the suspicious files, remove them, change all Joomla passwords and secrets, and audit the whole site, not only the iCagenda folders.
5. If you cannot update right away, rename the com_icagenda component folders; unpublishing the component or its menu item does not block the submit endpoint.

### How to check if you are affected

- Search access logs for the icagenda-batch/1.0 user agent and for requests to .php files under images/icagenda/frontend/attachments/.
- List files in images/icagenda/frontend/attachments/ and flag anything that is not an expected document or image.
- Check the iCagenda event queue for unapproved events you did not expect, which point to use of the guest-submission bypass.
- Look for new administrator accounts and recently modified PHP files elsewhere on the site.

## What happened

iCagenda is an events-calendar extension for Joomla, maintained by JoomliC. On June 15, 2026, automated attacks began hitting its frontend "Submit an Event" form. JoomliC dates them from 8 a.m. UTC that day. The form's file attachment feature kept whatever extension the visitor supplied and saved the file under the web root. A guest could upload a PHP file and then request it, which is remote code execution. A second flaw on the same path ignored the "Registered" access setting when processing submissions. That let anonymous visitors create unapproved events.

JoomliC shipped [iCagenda 4.0.8](https://www.icagenda.com/docs/changelog/icagenda-4-0-8) the same day, labeled "Critical Security release." [3.9.15](https://www.icagenda.com/docs/changelog/icagenda-3-9-15) followed on June 16 for Joomla 3. [mySites.guru](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/) spotted the attacks in a client's access log, reproduced the bug and reported it on June 15. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-48939) was published June 20 by the Joomla CNA, which scored it CVSS 4.0 10.0. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939) on July 10, with a federal deadline of July 13. The same KEV update added a similar Joomla extension bug, Balbooa Forms CVE-2026-56291, per [The Hacker News](https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html).

## Who is affected

The CVE covers iCagenda 3.2.1 through 4.0.7 (see also [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48939)). The dangerous half is narrower. JoomliC's [advisory](https://www.joomlic.com/news/icagenda-security-update/icagenda-security-update-version-4-0-8) scopes the critical vulnerability to Joomla 6.0.0 through 6.1.1. It explains: "Unsafe file uploads were already blocked by default on all Joomla versions prior to Joomla 6." It adds that Joomla 6.1.2 reinstated that default blocking. In practice, the shell upload worked on Joomla 6 sites below 6.1.2 running iCagenda 4.0.x before 4.0.8. The guest event-creation bypass affected every Joomla version.

Two later vendor releases matter for "which version is safe." [4.0.12](https://www.joomlic.com/news/icagenda-security-update/icagenda-security-update-version-4-0-12) (August 14) fixed an unauthenticated SQL injection in the calendar module, CVE-2026-67365, plus three lower-severity issues. 3.9.16 brought the applicable fixes to Joomla 3. [4.0.13](https://www.joomlic.com/news/icagenda-security-update/icagenda-security-update-version-4-0-13) (August 18) fixed a stored XSS, CVE-2026-75948, that was a regression introduced in 4.0.8. Stopping at 4.0.8 is not enough.

## Do you really need to act?

- **Joomla 6.0.0-6.1.1 with iCagenda 4.0.7 or earlier after June 15:** the attacks were automated and began before a patch existed, so assume you were scanned. Updating does not remove a shell that is already there. Hunt.
- **Joomla 3, 4 or 5 with an old iCagenda:** core blocked the PHP upload, so the RCE did not fire. You may have junk unapproved events. Update for the guest bypass and the August SQL injection.
- **No iCagenda:** nothing to do here.

This is a Joomla extension bug, so most development teams will not have it anywhere. The realistic audience is agencies and organizations running event or community sites on Joomla.

## What to do now

1. Find the versions. For iCagenda: `grep -h '<version>' administrator/components/com_icagenda/*.xml`. For Joomla: `grep -E 'MAJOR_VERSION|MINOR_VERSION|PATCH_VERSION' libraries/src/Version.php`.
2. Update iCagenda to 4.0.13 or later on Joomla 4-6, or to 3.9.16 or later on Joomla 3. Bring Joomla 6 to its latest release (6.1.2 or later restores the core upload block).
3. If you cannot update today, rename the `com_icagenda` folders, as mySites.guru advises. Unpublishing the component or menu item does not close the endpoint. Reinstall from a clean download afterwards.
4. Check the attachments folder now: `find images/icagenda/frontend/attachments -type f -iname '*.php*'`.

## How to tell if you were hit

mySites.guru describes the attack sequence. A scanner with the user agent `icagenda-batch/1.0` obtains a token, posts an upload to the submit endpoint, then fetches the planted file from `images/icagenda/frontend/attachments/`. Search logs with `grep -E 'icagenda-batch|icagenda/frontend/attachments/.*\.php' access.log*`. Treat any PHP file in that folder as a web shell until proven otherwise. Unexpected unapproved events in the queue show the access bypass was used. JoomliC's cleanup advice: keep copies of suspicious files as evidence, delete them, change Joomla passwords and credentials, and audit the entire site. Attackers often leave a second way in, such as new admin users or modified PHP files elsewhere. JoomliC also notes that a missing alert after updating does not prove the site is clean.

## Timeline

- Jun 15, 2026 — Automated attacks begin at 8 a.m. UTC. mySites.guru reports the bug, and JoomliC releases iCagenda 4.0.8.
- Jun 16, 2026 — iCagenda 3.9.15 is released for Joomla 3.
- Jun 20, 2026 — CVE-2026-48939 is published (CVSS 4.0 10.0).
- Jul 10, 2026 — CISA adds the CVE to KEV, with a federal deadline of July 13.
- Aug 14, 2026 — iCagenda 4.0.12 and 3.9.16 fix further bugs, including an unauthenticated SQL injection.
- Aug 18, 2026 — iCagenda 4.0.13 fixes a stored XSS regression introduced in 4.0.8.

## Sources

1. [JoomliC — iCagenda Security Update (version 4.0.8)](https://www.joomlic.com/news/icagenda-security-update/icagenda-security-update-version-4-0-8)
2. [iCagenda — Changelog 4.0.8](https://www.icagenda.com/docs/changelog/icagenda-4-0-8)
3. [iCagenda — Changelog 3.9.15](https://www.icagenda.com/docs/changelog/icagenda-3-9-15)
4. [JoomliC — iCagenda Security Update (version 4.0.12)](https://www.joomlic.com/news/icagenda-security-update/icagenda-security-update-version-4-0-12)
5. [JoomliC — iCagenda Security Update (version 4.0.13)](https://www.joomlic.com/news/icagenda-security-update/icagenda-security-update-version-4-0-13)
6. [CVE record — CVE-2026-48939](https://www.cve.org/CVERecord?id=CVE-2026-48939)
7. [NVD — CVE-2026-48939](https://nvd.nist.gov/vuln/detail/CVE-2026-48939)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-48939](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939)
9. [mySites.guru — iCagenda zero-day: file upload to RCE](https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/)
10. [The Hacker News — iCagenda and Balbooa Forms Joomla flaws exploited](https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html)

---
Source page: https://erroneo.us/security/briefs/icagenda-joomla-cve-2026-48939-file-upload-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt