Remote Code Execution in AcyMailing Enterprise via CVE-2026-94132

CVE-2026-94132 is a critical remote code execution (RCE) vulnerability affecting AcyMailing Enterprise for Joomla, versions 11.0.5 and earlier. The flaw exists because the plugin fails to perform file extension validation when processing MIME attachments from mailboxes configured in POP3 mode. When the plugin processes incoming emails to manage subscriptions or other mailbox actions, it saves attachments directly into the publicly accessible directory '/media/com_acym/upload/'. An attacker who identifies a Joomla site using this plugin can exploit this by sending an email containing a malicious PHP script as an attachment to the mailbox monitored by the application. Once the application retrieves the email via POP3, it automatically writes the file to the web root, allowing the attacker to trigger the code via a direct HTTP request. A working proof-of-concept exploit is publicly available, increasing the risk for organizations that have not yet applied the 11.1.0 security update.

Attack Chain

1. The attacker identifies a target Joomla site utilizing AcyMailing Enterprise with POP3 mailbox integration enabled.
2. The attacker drafts an email containing a malicious PHP payload as a MIME attachment.
3. The attacker sends the crafted email to the address monitored by the target's AcyMailing POP3 configuration.
4. The AcyMailing plugin connects to the POP3 server and retrieves the malicious email.
5. The plugin parses the MIME attachment and saves the file to the web-accessible directory: /media/com_acym/upload/.
6. The attacker navigates via browser or command-line tool to the path of the saved file (e.g., https://target.example/media/com_acym/upload/payload.php).
7. The web server executes the attacker's PHP script, resulting in remote code execution on the underlying server.

Impact

Successful exploitation leads to full remote code execution, enabling attackers to take control of the web server. This can result in unauthorized data access, exfiltration of sensitive Joomla database information, modification of website content, or the establishment of a persistent backdoor for future access.

Recommendation

Prioritize patching and configuration hardening to mitigate the risks associated with CVE-2026-94132.

• Upgrade AcyMailing Enterprise to version 11.1.0 or later immediately to patch the missing file extension validation.
• If immediate patching is not possible, disable the POP3 mailbox attachment handling feature or switch the mailbox configuration to IMAP mode if the business allows.
• Implement a restrictive .htaccess or Nginx configuration to deny execution of scripts within the /media/com_acym/upload/ directory.
• Monitor web server access logs for HTTP GET requests targeting the /media/com_acym/upload/ directory, particularly for .php files, to identify potential exploitation attempts.