CVE-2026-102785: YOOtheme Pro extension for Joomla 5.0.0-5.0.52

Affected technology

YOOtheme Pro extension for Joomla · 5.0.0-5.0.52
yootheme.com

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory. Vendor/CNA’s CVSS 4.0 assessment (base score 10.0/10) rates confidentiality, integrity and availability impact as high.