{"affected":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","source":"CNA: Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"4.1.0-4.1.5"}]}],"cveId":"CVE-2026-61900","cwes":["CWE-434"],"description":"Joomla Extension - jdownloads.com - Unauthenticated arbitrary file upload in jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.","epss":{"date":"2026-11-12","percentile":0.3914,"score":0.00445},"exploits":[],"kev":null,"metrics":[{"score":10,"severity":"critical","source":"CNA: Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"}],"modifiedAt":1794506462045,"publishedAt":1784572472512,"references":[{"source":"CNA: Joomla","tags":["product"],"url":"https://www.jdownloads.com/"},{"source":"CNA: Joomla","tags":["third-party-advisory"],"url":"https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/"}],"remediation":[],"revision":"a8bafd47ffc642a832d118b2135b5784b4ca96a9901be6bcce6e637090ddcfc7","sources":[{"modifiedAt":1794506462045,"name":"CNA: Joomla","retrievedAt":1794507095138,"url":"https://www.cve.org/CVERecord?id=CVE-2026-61900"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794507105591,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61900"}],"ssvc":{"assessedAt":1784651822259,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6","updatedAt":1794507105591}