AcyMailing RCE, unauthenticated email upload (CVE-2026-94132) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-94132 is a critical unauthenticated remote code execution vulnerability in the AcyMailing Enterprise extension for Joomla before 11.1.0 that lets anyone who can send an email to the monitored mailbox drop a PHP file into the site’s web root and execute arbitrary code on the server. Update to AcyMailing 11.1.0.

Overview

AcyMailing is a widely deployed Joomla newsletter and marketing extension. Its Enterprise tier includes a mailbox action feature that polls a configured email inbox and ingests incoming messages, for example to handle bounce processing or subscription replies. When a message arrives, the extension separates its MIME parts and writes attachments and other body segments to disk under media/com_acym/upload/.

Before version 11.1.0, that write path performed no extension validation. Whatever filename arrived in the MIME part was preserved, so a part named shell.php landed in an upload directory served from the Joomla document root. Because the mailbox is reachable by anyone who knows or guesses the address, the attacker needs no Joomla account, no session, and no interaction from a site administrator.

Impact

An unauthenticated attacker with only SMTP access to the monitored inbox achieves remote code execution as the web server user. That maps to full site compromise: reading configuration.php for database credentials, exfiltrating member data, installing webshells, pivoting to other hosts the web server can reach, or defacing the site. CVSS scores this 9.5, network vector, low complexity, no privileges and no user interaction required. The extension version range affected is AcyMailing Enterprise below 11.1.0.

Any Joomla site running the vulnerable extension with the mailbox action feature enabled and its upload directory writable and web-accessible should be treated as exposed.

Remediation

Upgrade AcyMailing Enterprise to 11.1.0 or later immediately. This is the only complete fix.

If you cannot patch at once, disable the mailbox action feature, or block PHP execution inside media/com_acym/upload/ through your web server configuration. For Apache, deny handler execution for that path; for Nginx, return 403 for .php under that directory. Restrict the mailbox address to trusted senders, and rotate it if it is published anywhere.

After patching, audit media/com_acym/upload/ for unexpected files, particularly anything with a PHP extension, and compare against a known-good backup. Review web server logs for POST and GET requests to files in that directory, since a successful upload is followed by direct invocation. If you find evidence of compromise, capture forensic artifacts before cleanup, and consult breach reports for context on how similar mass-exploitation campaigns unfolded.

Security Insight

This bug follows a pattern that recurs every time a CMS extension gains email ingestion: the developer trusts the mail server as a data source instead of treating every incoming message as hostile input. Attachment handling has produced the same class of flaw in helpdesk and ticketing plugins for years, and CVE-2026-94132 shows the lesson has not stuck in the Joomla ecosystem. The missing control here was trivial, a whitelist of allowed extensions, which suggests the mailbox feature shipped without any file-upload threat modeling at all.

Related coverage is available in our security news section.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs