The Phoca Downloads component for Joomla permits authenticated users to upload arbitrary files because the file‑type validation is absent. This flaw, identified as CWE‑434, allows the upload of executable scripts. When a user uploads such a file via the RSFiles interface, the code runs with the web server’s privileges, giving the attacker full control over the Joomla installation and potentially the underlying operating system.

The vulnerability applies to the Phoca Download extension for Joomla where the RSFiles component is dated earlier than version 6.1.3. Any Joomla site that has this extension installed and allows registered users to upload files through RSFiles is at risk. The flaw is not listed in CISA’s KEV catalog.

The flaw carries a CVSS score of 9, indicating critical severity. The EPSS score of <1% shows a very low likelihood of actual exploitation, although the attack requires only authenticated access and a standard web file‑upload form. Based on the description, the likely attack vector is authenticated use of the RSFiles upload interface, where an attacker with valid Joomla credentials uploads a malicious file that is then executed by the server.