The OrdaSoft Joomla Gallery extension for Joomla is vulnerable to remote code execution, posing a critical risk to the integrity and availability of the hosting environment.

This flaw exists in the updateOSGallery function, which processes a JSON request body and invokes a user supplied method as a PHP function. An attacker with administrative privileges can execute arbitrary system commands by passing malicious payloads to the package field.

The ability to execute arbitrary code on the server grants an attacker full control over the application and potentially the underlying web server. Given the CVSS score of 9.4, this vulnerability represents a critical threat that could lead to complete data exfiltration, unauthorized access to sensitive site configurations, and total service disruption.

Immediate Action: Update the OrdaSoft Joomla Gallery extension to version 6.2.7 or later immediately to resolve the vulnerable function call.

Proactive Monitoring: Review web server access logs for requests targeting the task=update_osgallery parameter, particularly those containing suspicious JSON payloads.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and block JSON traffic containing unexpected function calls or command execution keywords targeting the gallery extension.

Public Exploit Available: No (exploit_available: false)

This vulnerability is highly severe because it permits direct command execution within the application context. Administrators must prioritize updating the OrdaSoft Joomla Gallery extension to version 6.2.7 to eliminate this path for unauthorized code execution. Until the update is applied, ensure that access to administrative functions is strictly restricted to authorized personnel.