Unauthenticated PHP file write via signed image transformation handler in YOOtheme Pro for Joomla (CVE-2026-102785)
Three public exploits for this unauthenticated remote code execution flaw are in VulnCheck XDB and VulnCheck listed the CVE on 2026-10-27; no attacks are confirmed in published reports, but any public site on YOOtheme Pro 5.0.0–5.0.52 can be compromised with nothing more than one of its own image URLs.
YOOtheme Pro's publicly reachable image transformation handler does not fully bind the normalized image operations and output path to its request signature. An unauthenticated attacker can reuse a signature exposed in any legitimate public image URL, add extra operations, traverse out of the cache directory and write a PNG/PHP polyglot into an executable public media directory, gaining code execution on the web server.
Affected: YOOtheme Pro extension for Joomla 5.0.0 – 5.0.52; Patchstack lists the YOOtheme Pro theme for WordPress 5.0.0 – 5.0.52 for the same arbitrary file upload issue
How to Test
Check the installed YOOtheme Pro version in the Joomla extension manager (or the WordPress theme list); 5.0.0 through 5.0.52 is affected. To check for compromise, search the site's public media and cache directories for recently written .php files or PNG files containing PHP code, and review web server access logs for requests to the image transformation handler that carry path-traversal sequences or extra image operations appended to otherwise legitimate signed image URLs.
How to Patch
Update YOOtheme Pro to a release newer than 5.0.52 through the YOOtheme updater. Until the update is applied, block or restrict access to the image transformation handler at the web server or WAF, and ensure the public media directories cannot execute PHP.