Zero Radar
← feed
CriticalVulnerabilityCVE-2026-102785updated 25 Oct 2026, 16:35 UTC

YOOtheme Pro for Joomla can let anyone run code on the website

Someone on the internet with no login can trick the site into saving a hidden script file that the server then runs. That lets them take control of the website.

Official, 2 sources
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Anonymous attackerNo login or account needed
  2. 2Reuses public image URLSignature copied from a legitimate image link
  3. 3Image handler accepts changesExtra operations and output path not checked
  4. 4Writes hidden PHP fileDisguised as PNG in a public media folder
  5. 5Script runs on serverAttacker requests the file to execute it
  6. ResultAttacker controls the web server

What happened

YOOtheme Pro 5.0.0 through 5.0.52 has an unauthenticated remote code execution flaw in its public image transformation handler. Request signatures do not fully cover the image operations and output path, so an attacker can reuse a signature from a public image URL, add operations, traverse out of the cache directory, and write a PNG/PHP polyglot into an executable public media folder.

Why it is dangerous: Successful exploitation gives the attacker code execution on the web server, allowing them to steal data, change the site, or install malware. Any Joomla site running the affected YOOtheme Pro version is exposed to anonymous attackers.

Are you affected?

You are affected if your Joomla site uses YOOtheme Pro version 5.0.0 through 5.0.52.

YOOtheme Pro (Joomla extension) 5.0.0 to 5.0.52

What to do

  1. Check whether YOOtheme Pro is installed and which version it is on your Joomla site
  2. Check the vendor's advisory or YOOtheme for a patched version and update to it as soon as it is available
  3. Until patched, restrict or disable public access to the YOOtheme image transformation handler if your setup allows it
  4. Review public media and cache folders for unexpected PHP files and remove any you do not recognise

Timeline

  1. 22 Oct 2026, 13:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 13:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-102785 · GHSA-8w8j-f6ph-29mm
CVSS
10 / 10
EPSS
0.8% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 13:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

YOOtheme Pro for Joomla can let anyone run code on the website · Zero Radar