CVE-2026-115451
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
74/100
Published: 2026-11-05
Modified: 2026-11-06
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
None
Description
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.
Weakness Classification (1)
Affected Software (16)
| Vendor | Product | Version |
|---|---|---|
| tassos.gr | Advanced Custom Fields extension for Joomla | 3.1.4-3.1.8 |
| tassos.gr | Advanced Custom Fields extension for Joomla | 2.8.13-2.8.15 |
| tassos.gr | Advanced Custom Fields extension for Joomla | 3.1.4-3.1.8 |
| tassos.gr | Advanced Custom Fields extension for Joomla | 2.8.13-2.8.15 |
| tassos.gr | Advanced Custom Fields extension for Joomla | 3.1.4-3.1.8 |
| tassos.gr | Advanced Custom Fields extension for Joomla | 2.8.13-2.8.15 |
| tassos.gr | Advanced Custom Fields extension for Joomla | 3.1.4-3.1.8 |
| tassos.gr | Advanced Custom Fields extension for Joomla | 2.8.13-2.8.15 |
| tassos.gr | Smile Pack extension for Joomla | 2.1.2-2.1.6 |
| tassos.gr | Smile Pack extension for Joomla | 1.2.7-1.2.9 |
| tassos.gr | Smile Pack extension for Joomla | 2.1.2-2.1.6 |
| tassos.gr | Smile Pack extension for Joomla | 1.2.7-1.2.9 |
| tassos.gr | Smile Pack extension for Joomla | 2.1.2-2.1.6 |
| tassos.gr | Smile Pack extension for Joomla | 1.2.7-1.2.9 |
| tassos.gr | Smile Pack extension for Joomla | 2.1.2-2.1.6 |
| tassos.gr | Smile Pack extension for Joomla | 1.2.7-1.2.9 |
References & Advisories (1)
product