Security
DJ-Classifieds flaw allowed unauthenticated file uploads
mySites.guru has reported a high-severity file-upload vulnerability in the Joomla extension DJ-Classifieds, which was being probed in the wild before the vendor released a fix.
The issue affects DJ-Classifieds from versions up to and including 3.11.1. It allows unauthenticated visitors to submit files through the extension’s front-end image-upload endpoint without logging in or supplying a CSRF token. The vulnerability is tracked as CVE-2026-61424 and has been rated High.
Research published by mySites.guru says the upload restriction could be bypassed by disguising executable content inside a valid image file. While this does not automatically result in code execution on a standard server, the stored file could become dangerous on systems with permissive PHP handling or another local file-inclusion flaw. The researchers also observed anonymous requests targeting the endpoint in server logs, indicating exploitation or automated probing in the wild.
- Update DJ-Classifieds to
3.11.2, released by DJ-Extensions on 20 July 2026. - If immediate updating is impossible, block requests to the image-upload task at the firewall.
- Review affected sites and logs for unexpected uploaded files or other signs of compromise.
Originally reported by mySites.guru.