DJ-Classifieds for Joomla: unauthenticated file upload (CVE-2026-61424)
The Joomla extension DJ-Classifieds (dj-extensions.com) has a described vulnerability that allows unauthenticated arbitrary file upload, leading to full remote code execution (RCE). NVD lists a CVSS score of 10.
Checked in Shield: no
Who is affected
Joomla sites running the DJ-Classifieds extension in a version below 3.11.2.
How to check
In the Joomla admin, go to Extensions → Manage → Manage and find DJ-Classifieds. If the version is below 3.11.2, the site is affected. Also review upload directories for unfamiliar files, especially scripts.
How to fix
A fixed version exists: 3.11.2. Update the extension to it or later. If you cannot update right away, disable the extension in the meantime.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the flaw is exploited in the wild and the technical details are not disclosed yet. Source: NVD, CVE-2026-61424.
