{"schema":"vulnpedia.poc/1","cve":"CVE-2026-48939","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2026-07-10","ransomware":false},"epss":{"score":0.20069,"percentile":0.97426},"cvss":{"version":"4.0","score":10,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red"},"has_public_poc":true,"poc_sources":[{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/bc41036e1ff2","executable":false,"sourceId":"bc41036e1ff2","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"bc41036e1ff2","modified":"2026-07-10T00:00:00Z","url":"https://vulncheck.com/xdb/bc41036e1ff2"}],"repositoryUrl":"https://github.com/shinthink/CVE-2026-48939"}],"poc_candidates":[{"url":"https://github.com/Polosss/By-Poloss..-..CVE-2026-48939","source":"poc-in-github","sourceId":"CVE-2026-48939","description":"iCagenda Unauthenticated File Upload to RCE","modified":"2026-07-14T23:05:10Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48939","url":"https://github.com/Polosss/By-Poloss..-..CVE-2026-48939"},{"source":"poc-in-github","sourceId":"CVE-2026-48939","modified":"2026-07-14T23:05:10Z","url":"https://github.com/Polosss/By-Poloss..-..CVE-2026-48939"}],"tags":[]},{"url":"https://github.com/shinthink/CVE-2026-48939","source":"poc-in-github","sourceId":"CVE-2026-48939","description":"Pre-auth arbitrary file upload RCE exploit for iCagenda Joomla extension < 4.0.8 (CVSS 10.0)","modified":"2026-07-14T23:05:29Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48939","url":"https://github.com/shinthink/CVE-2026-48939"},{"source":"poc-in-github","sourceId":"CVE-2026-48939","modified":"2026-07-14T23:05:29Z","url":"https://github.com/shinthink/CVE-2026-48939"}],"tags":[]},{"url":"https://github.com/ChiefYoru/CVE-2026-48939_PoC","source":"poc-in-github","sourceId":"CVE-2026-48939","description":"iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.","modified":"2026-07-18T22:03:20Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48939","url":"https://github.com/ChiefYoru/CVE-2026-48939_PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-48939","modified":"2026-07-18T22:03:20Z","url":"https://github.com/ChiefYoru/CVE-2026-48939_PoC"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2026-48939 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-48939/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-48939.yaml","template":"http/cves/2026/CVE-2026-48939.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-48939%22&type=repositories","executable":false}]}