The Event Gallery extension for Joomla does not perform a CSRF token check when processing image uploads. A malicious site can send a forged request to the extension and cause it to upload a file that overwrites an existing file with the same name. If the overwritten file is an executable or script, an attacker could gain remote code execution or inject malicious content. This flaw corresponds to CWE‑352, representing a lack of proper cross‑site request forgery protection, which can compromise confidentiality, integrity, and potentially availability of the affected Joomla site.

The vulnerability affects the svenbluege.de Event Gallery extension for Joomla. All published releases prior to version 6.5.0 are vulnerable. The extension is available through the standard Joomla extension directory and can be installed alongside any Joomla site that uses the Event Gallery plugin.

The CVSS score of 5.1 indicates moderate severity. No EPSS data is provided, so the exploit probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a cross‑site request forgery where a visitor with upload permissions is tricked into sending a request to the extension, often by visiting a malicious external site. The attacker needs to know the target site’s URL and a user session that has permission to upload images. Successful exploitation allows the attacker to overwrite existing files and potentially execute malicious code.