Security
Events Booking flaws allowed uploads and user-data exposure
Two unauthenticated vulnerabilities in JoomDonation’s Events Booking Joomla extension allowed anonymous file uploads and exposed users’ names and email addresses.
mySites.guru published the research after privately reporting the issues to JoomDonation, with the Joomla Security Strike Team copied on the disclosure. The upload flaw affected Events Booking 5.7.1 and earlier, while a separate access-control problem allowed user details to be retrieved by ID.
The issues received three CVE identifiers: CVE-2026-58149, CVE-2026-60024 and CVE-2026-60025. The default upload configuration accepted files without authentication or a CSRF token. On affected sites, uploaded image files could also be served through a public endpoint. The default file allow-list limited the immediate risk, but the report said the flaw could enable remote code execution if administrators allowed executable file types.
JoomDonation shipped fixes in 5.8.0 and 5.8.1. Administrators should update to 5.8.1, which adds further upload protections. Joomla 3 sites should install 4.9.5; that release is unavailable in the public downloads area, so the updater or vendor support may be required. No proof-of-concept or exact attack requests have been published.
Originally reported by mySites.guru.