The vulnerability is an unauthenticated arbitrary file upload flaw in the Custom Tables extension for Joomla, affecting versions earlier than 3.7.8. An attacker can upload a polyglot file with any file extension to the web‑accessible temporary directory via the public submission form. The upload path is returned in the response, and the stored file is served as static content, enabling the hosting of phishing or malware pages under the victim’s domain.

This flaw impacts Joomla sites that have the joomlaboat.com Custom Tables extension installed with a version lower than 3.7.8, regardless of other site configuration. The product name is Custom Tables, and the vendor is joomlaboat.com.

With a CVSS score of 9.5, the vulnerability is considered critical. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based upload via an unauthenticated HTTP POST to the public form; the required privileges are none. Once exploited, the attacker can host arbitrary content on the target domain, potentially leading to phishing, malware distribution, or defacement.