This critical vulnerability in the iCagenda extension for Joomla allows unauthenticated remote code execution and is currently being actively exploited in the wild.

The application fails to properly validate file types during upload, allowing an unauthenticated attacker to upload malicious files. This unrestricted upload capability can be leveraged to achieve remote code execution (RCE) on the underlying web server.

The exploitation of this vulnerability poses a catastrophic risk to business operations, as it grants attackers full control over the web server. With a CVSS score of 9.5, this flaw permits total compromise of confidentiality, integrity, and availability. Successful exploitation can lead to complete data exfiltration, total system takeover, and the potential for lateral movement into the broader network environment.

Immediate Action: Apply the latest vendor-supplied updates immediately to patch the file upload validation logic.

Proactive Monitoring: Review web server access and error logs for suspicious file upload attempts or requests to unexpected file paths in the uploads directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads or restrict access to the component's upload functionality until a patch can be applied.

Public Exploit Available: Yes

Given the confirmed active exploitation and the high CVSS severity, this vulnerability must be treated as a top-priority incident. Organizations utilizing the iCagenda extension must verify their current version and apply the vendor-provided patch without delay to prevent system compromise.