PatchTheCVECVE-2026-102785: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOthem
CVE-2026-102785 is a critical-severity flaw (CVSS 10.0) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory,
Why this priority
- Critical severity
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 10.0 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.7% (top 47%) |
| CISA exploited list | No |
| Weakness | CWE-434 |
| Published | 2026-10-22 |
| Last modified | 2026-10-22 |
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: BIBILZERODAY/CVE-2026-102785---YooTheme-Mass-Exploit-Webshell.Store- (0 stars)
- GitHub PoC: antid00t/CVE-2026-102785 (0 stars)
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.