The vulnerability allows an authenticated user with unprivileged access to upload arbitrary files through the DJ-Classifieds extension. Once an attacker uploads a malicious payload, it can be executed by the web server, giving full remote code execution and compromising the confidentiality, integrity, and availability of the Joomla site. The weakness is an unprotected file upload path and is classified as CWE-434.

The affected product is the DJ-Classifieds Joomla extension from dj-extensions.com. Versions earlier than 3.11.3 are vulnerable; no specific sub‑version details were provided.

With a CVSS score of 9.4, this issue is considered critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation yet. The likely attack vector is via the web interface, requiring only authenticated but unprivileged access to the extension’s upload functionality. Because the flaw grants direct code execution, any successful exploitation would give the attacker full control of the affected server.