Critical Remote Code Execution via Unrestricted File Upload in iCagenda (CVE-2026-48939)
What It Is — iCagenda’s file‑attachment feature does not enforce proper file‑type validation, allowing an attacker to upload files that are treated as PHP scripts and executed on the server.
Exploitability — The vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) program; proof‑of‑concept code is publicly available, and exploitation requires only network access to the vulnerable web application. CVSS v3.1 scores 9.8 (Critical).
Affected Products — iCagenda event‑management extension for Joomla (all versions prior to the vendor’s forthcoming patch).
Why It Matters for Trust & Control Assurance
- Exposes a control gap in application hardening and file‑upload validation that maps to multiple framework objectives (e.g., NIST CSF Protect, ISO 27001 Asset Management).
- Underscores the need for continuous control mapping and auditable evidence that secure configuration controls are enforced.
- Auditors often request proof of file‑type restrictions; lacking verifiable controls can delay compliance assessments and erode buyer confidence.
Recommended Actions
- Apply the vendor‑issued patch or upgrade to a version where the upload validation is fixed.
- Implement strict whitelist‑based file‑type checks and store uploads outside the web root or with non‑executable permissions.
- Update your control inventory to include “File‑Upload Validation” and capture remediation evidence in your Trust Center for audit readiness.
Source: CISA KEV – CVE‑2026‑48939