The iCagenda extension for Joomla contains a flaw that allows an attacker to upload arbitrary files via the file attachment feature, ultimately leading to PHP code upload and execution. This is a classic privilege escalation leading to remote code execution, described by CWE-284, which can compromise the entire web application and underlying server.

The affected product is the iCagenda extension for Joomla, provided by icagenda.com. Versions older than Joomla 4.0.8 or 3.9.15 are vulnerable. No further version details are supplied by the CNA.

The CVSS score of 10 indicates the highest severity. EPSS data is unavailable, so the exact exploitation likelihood is unknown, but the vulnerability is known to be fully exploitable via the web interface's file attachment upload. The attack likely requires an authenticated session with permission to upload attachments, but the vulnerability description suggests that the impact is significant if a malicious file can be hosted in a location executed by the web server. The vulnerability is not listed in CISA KEV, but the potential for catastrophic compromise warrants immediate attention.