Alex Joseph
A critical security flaw has been identified in the AcyMailing Enterprise extension for Joomla!, posing a significant risk to websites using older versions. This vulnerability could allow attackers to execute malicious code on your server, potentially leading to a complete takeover of your website.
CVE Details
Product: AcyMailing Enterprise (Joomla! Extension)
Published: September 26, 2026
Severity: High (CVSS Score: 8.1)
Status: Analyzed
Affected Products
The Remote Code Execution (RCE) vulnerability affects AcyMailing Enterprise extension versions prior to 11.1.0. If you are running any version older than 11.1.0, your website is at risk.
Current Status
This vulnerability has been thoroughly analyzed, confirming the potential for severe impact. The issue stems from the mailbox action feature within the AcyMailing Enterprise extension. Specifically, MIME parts of incoming emails were saved to the media/com_acym/upload/ directory without proper extension checks. This oversight could be exploited by anyone capable of emailing the monitored mailbox, allowing them to write a PHP file directly into your web root, thereby enabling remote code execution.
Severity Level
Rated as “High” severity with a CVSS score of 8.1, this vulnerability is very serious. A Remote Code Execution (RCE) flaw means an attacker could run arbitrary code on your web server. This could lead to unauthorized access to your website’s data, defacement of your site, or even using your server for further attacks. The ease with which this vulnerability can be exploited by simply sending a crafted email makes it particularly dangerous.
Possible Solutions
The most crucial step to protect your Joomla! website is to update your AcyMailing Enterprise extension immediately. The vulnerability has been addressed in version 11.1.0 and later. We strongly recommend upgrading to the latest stable version available.
To mitigate this risk, follow these steps:
- Update AcyMailing: Ensure your AcyMailing Enterprise extension is updated to version 11.1.0 or higher. Always download updates from the official AcyMailing website or through your Joomla! extension manager.
- Regular Backups: Maintain a consistent schedule of full website backups. In case of a compromise, a recent backup can significantly reduce downtime and data loss.
- Monitor Activity: Keep an eye on your server logs for any unusual activity, especially in the
media/com_acym/upload/directory.
