YOOtheme Pro for Joomla contains an insecure image transformation handler that does not properly bind request signatures to both the requested image operations and the output directory. An unauthenticated attacker can reuse a legitimate image URL signature, inject arbitrary image operations, and traverse out of the intended cache directory. By doing so, the attacker can write a PHP‑aware PNG/polyglot file into a publicly writable media directory, thereby achieving remote code execution.

Versions 5.0.0 through 5.0.52 of the YOOtheme Pro extension for Joomla are vulnerable. All installations that have not applied an update beyond these versions are at risk. If a site uses a later version such as 5.0.55, the vulnerability may not be present, but confirm the version against the vendor’s release notes.

The flaw carries a CVSS score of 10, indicating critical severity. Because it can be triggered without authentication and does not rely on any user‑supplied input other than the image URL, it is highly exploitable in publicly accessible sites. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the zero‑auth remote code execution capability warrants immediate attention.