CVE-2026-102427 is a critical (CVSS 10.0) unauthenticated file upload flaw in OrdaSoft Joomla CCK, versions before 8.3.16, that leads to remote code execution. Update to 8.3.16 or later. If you cannot, disable the extension, because the vulnerable upload route needs no login.
What's affected
The record covers OrdaSoft Joomla CCK before 8.3.16. Use 8.3.16 or later; the record links only to the vendor's home page, so confirm the release there.
The upload handler is site/uploader.php, reached through the component's normal frontend routing with the getContent task. No authentication or access control check exists anywhere in that dispatch chain, per the record.
How to check if you're exposed
This is a Joomla extension, so check inside Joomla.
- In the administrator area, open System, then Manage, then Extensions, and search for Joomla CCK.
- Read the installed version. The record covers Joomla CCK before 8.3.16.
- Check the files on the server too, since a site can carry a copy of an extension that is disabled but still reachable. Look for the extension's directory under
components.
If you manage many sites, list installed extensions across all of them and compare against this record.
What to do now
- Update the extension to 8.3.16 or later. Download it from the vendor, since the record points only to the vendor's home page.
- If you cannot update today, disable or uninstall the extension and remove its public pages from the menu.
- Look for unexpected files with a PHP extension in the web root and in upload folders under the extension. Anything you did not put there needs investigating.
- Check your web server and application logs for unusual requests to the extension's pages since the record was published. A log review proves nothing in either direction by itself, but it can show you what to look at next.
- Rescan your inventory afterwards to confirm the vulnerable version is gone from every site.
Why it matters
The record describes a content check that uses real magic-byte detection, so the file looks like an image. But the extension allow-list was present in the source and commented out. The saved file took its extension from the visitor's filename and was written under the web root, where the PHP handler runs it. That is an unrestricted file upload, filed as CWE-434.
Checking content is not enough. A safe upload handler should choose the file name and extension itself, store files outside the executable web root, and refuse to run anything in the upload folder.
The record does not report exploitation in the wild, and the KEV flag is false.
Quick check
Does the content type check protect me?
No. The record says the content check was real, but the extension was taken from the visitor's file name, so the check did not stop a file from being saved with an executable extension.
Sources
Last reviewed: 19 October 2026.
