A critical remote code execution vulnerability in the OrdaSoft Joomla Gallery extension allows high-privileged users to compromise the entire server environment.

The saveWatermark function fails to perform necessary validation on uploaded files, allowing an authenticated user with core.manage privileges to upload and execute arbitrary PHP code. This vulnerability stems from a lack of filename sanitization and extension checking, permitting files to be saved directly into a web-accessible directory.

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary commands on the underlying web server. Given the CVSS score of 9.4, this vulnerability poses a severe risk of full system compromise, including unauthorized data access, lateral movement within the network, and potential total loss of service availability.

Immediate Action: Upgrade the OrdaSoft Joomla Gallery extension to version 6.2.7 or higher immediately upon availability. If an update is not currently accessible, disable the extension to prevent further exploitation.

Proactive Monitoring: Review web server access logs for suspicious requests targeting uploaded image directories or unusual file extensions. Monitor for unauthorized creation of new PHP files within the application directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing prohibited extensions or suspicious content-type headers. Restrict administrative access to the Joomla core.manage capability to only trusted personnel.

Public Exploit Available: No

The severity of this vulnerability, combined with the potential for total system compromise, requires immediate attention. Administrators must prioritize updating the OrdaSoft Joomla Gallery extension and audit administrative user accounts to ensure only authorized individuals hold the core.manage capability. Failure to patch or mitigate this risk leaves the server open to full remote control by an attacker.