YOOtheme Pro Image Handling Flaw Enables Unauthenticated RCE in Joomla 5.0.0-5.0.52
An image handling flaw in YOOtheme Pro allows attackers to upload executable files without authentication, affecting versions up to 5.0.52.
Key points
- The National Vulnerability Database rates CVE-2026-102785 as critical due to unauthenticated remote code execution.
- The flaw exists in YOOtheme Pro versions 5.0.0 through 5.0.52 for the Joomla platform.
- Attackers exploit incomplete signature binding to write polyglot files to public directories.
The YOOtheme Pro extension for the Joomla content management system contains a severe security flaw that permits unauthenticated remote code execution. This vulnerability affects installations running versions 5.0.0 through 5.0.52. The National Vulnerability Database assigns CVE-2026-102785 a critical severity rating. Environments relying on this extension for theme management or image processing are exposed to this risk. The flaw resides in the publicly accessible image transformation handler, which fails to properly bind operations to request signatures.
Root cause
The underlying issue stems from how the extension handles image transformation requests. According to the NVD record, the publicly accessible image transformation handler incompletely binds normalised image operations and the output destination to its request signature. This incomplete binding allows the system to accept modifications that were not part of the original request. The weakness is categorised under CWE-434, indicating a failure in enforcing security boundaries for file operations. This architectural oversight creates a window for manipulation by external actors.
Attack path
An attacker can exploit this flaw by reusing a signature that is disclosed in a legitimate public image URL. By injecting additional image operations into the request, the adversary can traverse out of the intended cache directory. This path traversal allows the attacker to write an attacker-controlled PNG or PHP polyglot file to an executable public media directory. The entire process requires no authentication, making it accessible to any remote actor with network access to the site. The source material specifies the ability to write these files, enabling remote code execution.
Affected versions
- YOOtheme Pro 5.0.0
- YOOtheme Pro 5.0.52
- All intermediate versions of YOOtheme Pro for Joomla between 5.0.0 and 5.0.52
Mitigation
- Verify if your site runs YOOtheme Pro for Joomla and check the installed version number.
- Isolate affected servers from untrusted networks if an immediate software update is unavailable.
- Monitor public media directories for unexpected file types or recent modifications.
- Restrict write permissions on public directories to the absolute minimum required for operation.
Signals worth monitoring
Security operations teams should focus on web server access logs for unusual image transformation requests. Look for HTTP POST or GET requests targeting image handling endpoints that include unexpected parameters or encoded data. File integrity monitoring alerts are crucial; teams should investigate any new PHP or executable files appearing in public media or cache directories. Additionally, monitor for outbound connections from the web server that do not match normal application behaviour, which could indicate command and control activity following code execution.
What to do and how to stay safe: YOOtheme Pro
- Audit your Joomla installation to confirm whether YOOtheme Pro is present and identify the specific version number.
- Implement strict file permission controls on directories that store user-uploaded or processed media to limit executable file creation.
- Configure web application firewalls to detect and block requests containing suspicious image manipulation parameters or path traversal sequences.
- Prepare an incident response plan that includes steps for isolating compromised hosts and restoring clean backups.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific versions of YOOtheme Pro are vulnerable?
The vulnerability affects YOOtheme Pro versions 5.0.0 through 5.0.52 for Joomla.
Is authentication required to exploit this flaw?
No, the National Vulnerability Database describes the flaw as allowing unauthenticated remote code execution.
What type of file can an attacker upload?
An attacker can write a PNG or PHP polyglot file to an executable public media directory.
