NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksUpdated

iCagenda file-upload flaw CVE-2026-48939 exploited to run code on Joomla websites; fixes available

Attackers used iCagenda's event attachments to upload and run malicious files on Joomla websites. The flaw was fixed in June. Website owners should install the current release and check for earlier compromise; visitors have no software to update.

What to do

If you own a Joomla website, ask its maintainer to update iCagenda to 4.0.17 or later, or PRO 3.9.17 on Joomla 3, and check the whole site for earlier compromise. Free iCagenda 3.9 is no longer supported; arrange migration to a supported Joomla version. Website visitors have no software to update for this flaw.

What’s happening

CVE-2026-48939 affects iCagenda, an events-calendar extension for Joomla websites. Missing checks in event submission let attackers upload executable files without signing in. Automated attacks began on 15 June, before the same-day release of iCagenda 4.0.8; legacy version 3.9.15 followed on 16 June. CISA listed the flaw as exploited on 10 July. JoomliC says the dangerous upload affected Joomla 6.0.0–6.1.1, while earlier Joomla versions were exposed to a related guest event-submission flaw. MCP Security Research disputes that limit, reporting that iCagenda 4.0.0–4.0.7 also exposes Joomla 4 and 5 sites. Both recommend updating iCagenda. The June fixes remain valid for this incident, but October releases 4.0.17 and PRO 3.9.17 address separate flaws and are the current update targets. Updating does not remove an existing compromise. The reviewed sources do not establish how many websites were compromised or when attacks ended.

What
Flaw
Affects
iCagenda events-calendar extension for Joomla websites
Affected
iCagenda 3.2.1–3.9.14: legacy branch included in the published affected range; JoomliC describes the Joomla 3 issue as unauthorised guest event submission.
iCagenda 4.0.0–4.0.7.
JoomliC scopes the critical file-upload vulnerability to Joomla 6.0.0–6.1.1; its compatibility table lists iCagenda 3.9.14–4.0.7 on those Joomla versions. MCP Security Research disputes the Joomla-only scope.
Fixed in
iCagenda 4.0.8
iCagenda 3.9.15
CVE
CVE-2026-48939
Since
10 July 2026

Timeline

  1. Update

    JoomliC released 4.0.17 and PRO 3.9.17 for separate security flaws, making these the current update targets. Free 3.9 support had ended on 13 October; PRO support was extended to 13 October 2027.

  2. CISA added

    CISA added CVE-2026-48939 to its Known Exploited Vulnerabilities catalogue, as recorded by MCP Security Research.

  3. Vendor revised

    JoomliC clarified that the critical upload flaw affected Joomla 6.0.0–6.1.1. It distinguished this from a guest event-submission flaw affecting all Joomla versions.

  4. New fixFixed

    JoomliC released iCagenda 3.9.15 for Joomla 3, fixing guest access to event submission.

  5. Wider attacksNo fix yet

    JoomliC dates the start of automated attacks against iCagenda websites to this time, before a fix was available.

  6. New fixPartly fixed

    JoomliC released iCagenda 4.0.8 to fix unauthenticated code execution. The legacy branch's update followed the next day.

Sources

  1. iCagenda Security Update (version 4.0.8)JoomliC · 15 June 2026
  2. iCagenda 4.0.8 (Security Release)JoomliC · 15 June 2026
  3. iCagenda Security Update (version 4.0.17)JoomliC · 27 Oct 2026
  4. Zero Day Vulnerability Found in iCagenda Joomla ExtensionmySites.guru
  5. ICagenda Product Security Update Advisory (CVE-2026-48939)AhnLab ASEC · 13 July 2026
  6. iCagenda Security NoticeMCP Security Research
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS