HTProtect.org
Independent information site on Joomla security vulnerabilities
EN
HTProtect HTProtect JOOMLA SECURITY
New htprotect.app - Centralized Joomla Site Management for Multiple Websites
htprotect.org Vulnerabilities & update guides
New htprotect.app - Centralized Joomla Site Management for Multiple Websites
Security vulnerability

iCagenda – critical unauthenticated file upload

CriticalCVE-2026-48939
Act now
Update iCagenda to 4.0.8 (on Joomla 3, to 3.9.15).
Download the secure version Go to the update steps

Secure version: iCagenda 4.0.8 (Joomla 3: 3.9.15) · free download

At a glance

Affected extension
iCagenda – event calendar
Vendor
iCagenda
Type of flaw
Missing login check in the event form (guests can create events); on Joomla 6 a critical unauthenticated file upload
Affected versions
iCagenda 3.2.1 to 4.0.7
Secure version
iCagenda 4.0.8 (Joomla 3: 3.9.15)   Download
Severity
Critical
CVE
CVE-2026-48939
Joomla compatibility
Joomla 3 / 4 / 5 / 6
Status / published
Published: 15 June 2026

What is this about?

iCagenda is a widely used extension for event calendars. The form for submitting events lacked a real login check – so even unauthenticated visitors could create events, even when the form was intended for registered users only. On Joomla 6 (6.0.0–6.1.1) this can be turned into a file upload – there the flaw is critical; other Joomla versions are not affected by that.

Affected is iCagenda 3.2.1 to 4.0.7 (versions before 3.2.1 are not affected). The fix shipped as iCagenda 4.0.8 on 15 June 2026; for Joomla 3 there is additionally iCagenda 3.9.15 (16 June 2026). The flaw is tracked as CVE-2026-48939.

Uploaded files typically end up under images/icagenda/frontend/. An .htaccess rule can prevent PHP execution in this folder – a sensible hardening measure, but it does not replace the update.

Time is a factor
Once technical details become public, automated scanners typically pick up such flaws within hours. Update promptly.

Am I affected? – How to check

  1. Open the back end

    Log in to the Joomla administrator.

  2. Check the iCagenda version

    Open Extensions›Manage›Manage and filter for "iCagenda".

  3. Assess the version

    If the version is between 3.2.1 and 4.0.7, action is needed – on Joomla 6 the flaw is critical.

How to fix it

Before any update: back up
Back up your files and database before updating – so you can roll back if anything goes wrong (e.g. via Akeeba Backup or your host).
  1. Open the Update center

    Go to System›Update›Extensions and click Check for updates.

  2. Update iCagenda

    Select the iCagenda entry and click Update (target version 4.0.8; on Joomla 3, 3.9.15).

  3. Verify the version

    Confirm that 4.0.8 (or 3.9.15 on Joomla 3) or newer is now installed.

Manual installation (alternative)
Alternatively, download the package from icagenda.com and install it via Extensions›Manage›Install. Important: do not restore old backup files – install version 4.0.8 (on Joomla 3: 3.9.15) cleanly.
Download the secure version

Official source: free download. Make sure you have at least iCagenda 4.0.8 (Joomla 3: 3.9.15).

Has the site already been attacked?

Already-attacked sites need more than an update
Check the folder images/icagenda/frontend/ for foreign files. If compromised, a structured clean-up is required – simply deleting individual files is not enough.

Need help with the clean-up? Find qualified specialists in the Joomla Service Providers Directory.

Sources & further reading

The official information from the respective vendor always takes precedence. This page neutrally summarises publicly available information.

Related vulnerabilities

Other extensions with comparable weaknesses. Check whether any of them is installed on your site.

JCE EditorCriticalactively exploited
JoomlaContentEditorLearn more
Helix3 FrameworkCriticalactively exploited
JoomShaperLearn more
Astroid FrameworkCriticalactively exploited
TemPlazaLearn more
Back to all vulnerabilities
Supporters

Supporters of this site

htprotect.org is a free, vendor-independent information service. It is supported by:

Host & community
FC-Hosting

Joomla host from Germany with active community support – discovered the first attack on the JCE vulnerability.

fc-hosting.de
Initiator & operator
Website-Bereinigung.de

Specialised in cleaning, maintaining and securing Joomla and WordPress websites.

website-bereinigung.de

Support this project

You run a hosting or Joomla service and would like to support htprotect.org – and be listed here as a supporter? Every contribution helps to warn and protect those affected faster.

Prefer to give privately, without a listing? A little something for the tip jar is just as welcome.

Support HTProtect now
Bauschild & Service

Manufactures and installs construction-site signs, hoardings and façade solutions – including design and 3D visualisation.

bauschildundservice.de
IT Specialista

Professional IT support from Czechia – Windows management, domain administration and web hosting.

defendersoft.cz
onlineweg.de

Travel portal from Germany – package holidays, hotels and flights online, with personal travel-agency advice.

onlineweg.de
Criadero

Creative agency from Brandenburg – web design, print media, photography and 360° panoramas from a single source.

criadero.de
Jahn EDV-Dienst GmbH

IT service provider from Wächtersbach – Joomla websites, PC service, hardware and software.

jahnedv.de
IsariConsult

Information-security consulting from Berlin – security analyses, risk management and ISO 27001 for SMEs.

isari-consult.de
Schippelbein Mediengestaltung

Media design from Friedrichshafen – Joomla and WordPress sites, online shops, graphics and 3D.

schippelbein.com