The OrdaSoft Joomla Gallery extension for Joomla versions less than 6.2.7 contains a critical vulnerability that allows authenticated, privileged remote code execution. This vulnerability exists in the saveWatermark() function, which copies an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitis [truncated]
A critical vulnerability was found in the OrdaSoft Joomla Gallery extension for Joomla versions less than 6.2.7. The updateOSGallery() function, accessible via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, without any allow-list or is_callable() check.
The CVE-2026-88855 vulnerability in the OrdaSoft Joomla Gallery extension allows an authenticated user with core.manage permissions to inject SQL, potentially leading to unauthorized database access. This vulnerability exists due to improper sanitization of user input in the saveGallery() function, which concatenates form data directly into SQL queries without proper quoting or integer casting. As a resul [truncated]
CVE-2026-88854 is a critical unauthenticated SQL injection vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions less than 6.2.7. The vulnerability exists in the showSearchResult() and showSearchResultAjax() functions, which read the textsearch/searchText request parameter without proper filtering, allowing an attacker to inject malicious SQL code. This vulnerability is particularly c [truncated]
