CVE-2026-61900 Details

A vulnerability in the Joomla extension jDownloads, specifically in versions 4.1.0 through 4.1.5, allows for unauthenticated file uploads via a script that was unintentionally included in the release package. This script, located in the 'administrator/components/com_jdownloads/assets/upload/' directory, lacks essential security checks such as authentication, CSRF protection, and permission validations. While the script's extension whitelist excludes PHP files, it permits other file types, including executables, which could be exploited under certain server configurations to achieve remote code execution. The vulnerability arises from the script's disregard for jDownloads' built-in upload safeguards, enabling anonymous users to upload files that could be executed or used maliciously.

Users are advised to update jDownloads to version 4.1.6, which removes the vulnerable upload handler and clears any leftover test uploads. If an immediate update is not possible, the upload-handler.php file can be deleted manually as a temporary measure.