The vulnerability permits the upload of files with an SHTML extension, which are then processed by the web server. Because the default blacklist in Joomla does not include SHTML, an attacker can upload a file containing server‑side include directives or other executable code, resulting in remote code execution on the target server. This flaw allows a determined adversary to compromise application confidentiality, integrity, and potentially availability by leveraging the server’s execution context. The weakness is captured by CWE‑434, which represents an unsafe file upload that fails to validate file types.

All Joomla CMS releases from version 1.0.0 up to and including 5.4.7, as well as 6.0.0 through 6.1.2, are affected. The Joomla Framework Filesystem package also suffers from the same oversight in its dangerous‑file filtering logic. Administrators should verify if they are running any of these versions or the Joomla Framework package within this range.

The CVSS base score of 8.9 indicates high severity, and the EPSS score is currently unavailable, implying no concrete assessment of exploit probability, though the lack of a KEV listing suggests it has not yet been widely observed. The attack vector is inferred to be through the media library or other file‑upload functionality that is accessible to authenticated or unauthenticated users, depending on site configuration. If the server interprets SHTML files, an attacker can inject and execute code upon upload, resulting in full host compromise.