The StageIt extension for Joomla allows an attacker to inject arbitrary PHP code by setting specific strings in its configuration. This flaw is a code‑injection vulnerability that enables an attacker to execute arbitrary commands on the server, compromising confidentiality, integrity, and availability of the affected site.

The vulnerability exists in the StageIt extension provided by php-web-design.com for Joomla, affecting versions 1.0 through 5.7.5 and 6.0 through 6.3.5.

The flaw has a CVSS score of 8.6, indicating a high severity. The EPSS score is not available, so the exact exploitation probability is unknown, but the exposed ability to run arbitrary code makes it a high‑risk issue. It is not listed in the CISA KEV catalog, but that does not reduce the need for immediate remediation. Likely attack vectors involve sending crafted requests to the extension’s configuration interface, which is typically accessible to site administrators.