CVE-2026-48906

Published: May 27, 2026Modified: Oct 14, 2026

9.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:XShow less

Source: security@joomla.org (Secondary)

Description

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Affected (14)

Products: Tassos: Advanced Custom Fields, Convert Forms, Engagebox, Google Structured Data, Mailchimp Auto Subscribe, Smile Pack, Tassos Code Snippets, Tassos Framework

Tassos

8 products

Advanced Custom Fields

Convert Forms

Engagebox

Google Structured Data

Mailchimp Auto Subscribe

Smile Pack

Tassos Code Snippets

Tassos Framework

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Tassos Advanced Custom Fields	1.0.0 ≤ version ≤ 2.8.12
Tassos Advanced Custom Fields	3.0.0 ≤ version ≤ 3.1.3
Tassos Convert Forms	1.0.0 ≤ version ≤ 4.4.12
Tassos Convert Forms	5.0.0 ≤ version ≤ 5.1.5
Tassos Engagebox	1.0.0 ≤ version ≤ 6.3.11
Tassos Engagebox	7.0.0 ≤ version ≤ 7.1.1
Tassos Google Structured Data	1.0.0 ≤ version ≤ 5.6.11
Tassos Google Structured Data	6.0.0 ≤ version ≤ 6.1.9
Tassos Mailchimp Auto Subscribe	1.0.0 ≤ version ≤ 5.0.5
Tassos Mailchimp Auto Subscribe	5.1.0 ≤ version ≤ 5.2.0
Tassos Smile Pack	1.0.0 ≤ version ≤ 1.2.6
Tassos Smile Pack	2.0.0 ≤ version ≤ 2.1.0
Tassos Tassos Code Snippets	Version 1.0.0
Tassos Tassos Framework	1.0.0 ≤ version ≤ 6.0.1

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (1)

https://tassos.gr

Source: security@joomla.org

Product

Timeline

No history available yet.