Skip to main content
Change Risk Intel
CVE tracker

CVE-2026-48939 — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

CVSS
9.8 (Critical)
KEV status
CISA KEV — Listed
First seen (CISA KEV)
Recommended change window
Emergency change — iCagenda is a public event-calendar extension; disable or update within 48 hours.
Vendor advisory
https://www.icagenda.com/#download
Affected products
iCagenda iCagenda

Why this one matters to a CAB

iCagenda is a Joomla event calendar. If your organization runs a conferences microsite, an event registration page, or a community calendar on Joomla, iCagenda is likely installed. The upload flaw is in the attachment feature, which means end users are the ingress path — nobody has to authenticate.

Defender’s angle

  • Attachment feature audit: even after patching, the CAB should ask whether the attachment feature is required. Turning it off is a durable mitigation and reduces future CVE exposure.
  • PHP upload directory hardening: .htaccess deny of .php/.phtml/.phar execution inside /images/icagenda/ is the belt-and-braces defense; it should be in place regardless of the CVE.
  • Purge existing uploads: if the site has been public for any meaningful period, run a webshell scan (grep -R "eval(base64_" /var/www) before restoring service after the update.

What to bring to CAB

A change record that includes a webshell-scan step before the patch is called done. Patching without a clean scan is not remediation, it is closing the door after the horse leaves.

Sources

This page summarizes publicly available information from CISA KEV, NVD, and the listed vendor advisory. Change Risk Intel does not publish exploit walkthroughs. Verify with your vendor before scheduling any change window.