How severe is CVE-2026-102785?

CVE-2026-102785 has a CVSS 4.0 base score of 10.0, rated critical severity.

Is CVE-2026-102785 being actively exploited?

It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.

How do I fix CVE-2026-102785?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-102785 published?

CVE-2026-102785 was published on 2026-10-22.

CVE-2026-102785

CVE-2026-102785 is a critical-severity vulnerability with a CVSS 4.0 base score of 10.0. The underlying weakness is classified as CWE-434.

Key facts

Severity: Critical (CVSS 4.0 base score 10.0)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-434
Published: 2026-10-22
Last modified: 2026-10-22

Description

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

Frequently asked questions

What is CVE-2026-102785?: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
How severe is CVE-2026-102785?: CVE-2026-102785 has a CVSS 4.0 base score of 10.0, rated critical severity.
Is CVE-2026-102785 being actively exploited?: It is not currently listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS exploit-prediction score is available yet.
How do I fix CVE-2026-102785?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-102785 published?: CVE-2026-102785 was published on 2026-10-22.

References

https://www.yootheme.com/

Other CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities

CVE-2026-111832 — Critical (CVSS 10.0): Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a…
CVE-2026-105899 — Critical (CVSS 10.0): ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in…
CVE-2026-94503 — Critical (CVSS 10.0): Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a…
CVE-2026-39770 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
CVE-2026-32579 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
CVE-2026-102427 — Critical (CVSS 10.0): Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 -…

Browse all CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities →