{"id":"CVE-2026-94131","aliases":[],"cve":{"records":[{"id":"CVE-2026-94131","source":"Joomla","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-20T18:03:41.238Z","published":"2026-09-26T14:14:23.396Z","modified":"2026-11-12T18:04:37.959Z"}],"publishers":[{"name":"Joomla","role":"CNA","organizationId":"6ff30186-7fb7-4ad9-be33-533e7b05e586","modified":"2026-11-12T18:04:37.959Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-26T22:57:55.957Z"}],"references":[{"url":"https://www.acymailing.com/","tags":["product"],"source":"Joomla"}],"weaknesses":[{"id":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","source":"Joomla"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-26T22:57:46.440866Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0","titleSource":"Joomla","descriptionSource":"Joomla","description":"Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.","score":8.3,"severity":"high","published":"2026-09-26T14:14:23.396Z","modified":"2026-11-12T18:04:37.959Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Datasolution","name":"AcyMailing extension for Joomla","platforms":[],"versions":[{"version":"6.0.0-11.0.5","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"Joomla","url":"https://www.cve.org/CVERecord?id=CVE-2026-94131"}],"remediation":[],"references":["https://www.acymailing.com/"],"sources":[{"name":"CVE","id":"CVE-2026-94131","modified":"2026-11-12T18:04:37.959Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-94131"}],"assessments":[{"source":"Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.3}],"sourceAffected":[],"observedAt":"2026-11-12T19:40:24.468Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:25:34.584Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T20:05:37.470Z","attemptedAt":"2026-11-12T20:05:37.470Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T20:05:36.068Z","attemptedAt":"2026-11-12T20:05:36.068Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T20:05:36.066Z","attemptedAt":"2026-11-12T20:05:36.066Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-12T20:05:36.055Z","attemptedAt":"2026-11-12T20:05:36.055Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-94131","url":"https://www.first.org/epss/","probability":0.00263,"percentile":0.18356,"date":"2026-11-12","checkedAt":"2026-11-12T20:05:36.055Z"},{"source":"ENISA EUVD","id":"EUVD-2026-87773","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87773","modified":"Nov 12, 2026, 6:04:37 PM","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","checkedAt":"2026-11-12T20:05:36.066Z"},{"source":"GitHub Advisory Database","id":"GHSA-657v-94xx-8q7f","url":"https://github.com/advisories/GHSA-657v-94xx-8q7f","modified":"2026-10-20T21:30:37Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","checkedAt":"2026-11-12T20:05:36.068Z"},{"source":"NVD","id":"CVE-2026-94131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94131","modified":"2026-11-12T19:17:06.243","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-12T20:05:37.470Z"},{"source":"NVD","id":"CVE-2026-94131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94131","modified":"2026-11-12T19:17:06.243","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","checkedAt":"2026-11-12T20:05:37.470Z"}],"aiSummary":null}