Description

Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:17:09.963Z",
  "pubdate": "2026-11-05T19:17:09.963Z",
  "executiveSummary": "The Advanced Custom Fields extension for Joomla and its associated Smile Pack are susceptible to a critical improper access control vulnerability that allows for unauthorized file deletion and sensitive data exposure.\nThe vulnerability resides in the insufficient validation of user requests, enabling unauthenticated attackers to remotely delete images stored within Gallery folders. This encompasses assets currently deployed across active articles and modules, leading to potential site-wide defacement and service disruption.\nFurthermore, in specific versions of the Advanced Custom Fields extension (3.1.7 and 3.1.8), the flaw extends to the unauthorized access of user-specific unsaved uploads. Attackers can view, download, or remove files uploaded by other users, creating a significant risk of data privacy breach and information leakage.\nBecause these operations do not require authentication, the risk level is high. The exploit allows an external threat actor to manipulate the server-side filesystem and access private user data without valid credentials. Immediate remediation is required for affected deployments.",
  "technicalDetails": "The vulnerability originates from inadequate access control enforcement within the Advanced Custom Fields and Smile Pack extensions. The core issue lies in the lack of identity verification and authorization checks on server-side functions responsible for processing file management requests.\nRoot Cause: The extension's administrative controller fails to enforce session-based authorization or CSRF tokens for sensitive file operations. Consequently, the backend does not distinguish between a legitimate administrator performing a management task and an unauthenticated remote attacker submitting a malicious HTTP request targeting the filesystem.\nExploitation Method: Attackers can craft malicious HTTP requests that trigger the file deletion routine. By manipulating input parameters, the attacker can force the application to iterate through and remove files within the designated Gallery folders. Since there is no validation of the requester's privilege level, the application blindly executes the delete command on the specified directory paths.\nAttack Flow: An attacker probes the web application to identify the endpoint responsible for file management. Once identified, the attacker crafts a request targeting the server's storage path. Because the endpoint lacks authentication middleware, the server processes the request as if it were a local administrative action. Upon successful execution, the target image files are unlinked from the server's storage. In instances involving sensitive unsaved uploads (versions 3.1.7 and 3.1.8), the attacker can similarly query the temporary storage directory to retrieve or modify data belonging to other users.\nAffected Components: Advanced Custom Fields (2.8.13-2.8.15, 3.1.4-3.1.8) and Smile Pack (1.2.7-1.2.9, 2.1.2-2.1.6).\nPost-Exploitation: Successful exploitation leads to permanent loss of media assets, causing broken image references on public-facing site content. In cases where user-uploaded files are accessible, the vulnerability leads to the exposure of private metadata, proprietary images, or personal user information, violating the principle of data confidentiality."
}