Unauthenticated remote code execution in yootheme.com YOOtheme Pro for Joomla image handler

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

• YOOtheme Pro extension for Joomla from yootheme.com: versions 5.0.0-5.0.52 are identified as affected; the CNA record marks versions outside the listed range as unaffected by default.
• YOOtheme Pro 5.0.53: the YOOtheme vendor changelog records this release as fixing unauthenticated remote code execution via the image handler.
• The CNA record does not define additional affected or fixed branches. Do not infer that later or parallel branches not independently verified are unaffected.

YOOtheme Pro exposes a publicly accessible image transformation handler that uses a request signature associated with image-processing requests. The flaw is that the signature incompletely binds normalized image operations and the output destination. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, move the write outside the intended cache directory, and write attacker-controlled content into an executable public media directory. The resulting PNG/PHP polyglot can enable server-side code execution if the web server and PHP configuration execute content from that location. The exact route, parameter names, file naming behavior, and execution configuration are not established by the available evidence; the weakness is classified as CWE-434.

The vulnerability is remotely reachable over the network and does not require authentication or user interaction. The supplied record describes low attack complexity, but exploitation still requires a publicly accessible image handler and a legitimate public image URL that exposes a reusable signature. The supplied record does not establish whether exploitation has occurred and does not identify a public exploit. No specific campaign, victim, or indicator is confirmed.

The direct technical outcome is attacker-controlled file creation in a public media directory rather than only in the intended cache directory. Because the file is described as a PNG/PHP polyglot and the destination is executable, server-side code execution may follow if the target web server and PHP configuration interpret content from that location. If code executes, confidentiality, integrity, and availability within the web-serving process's permissions may be affected. Actual scope depends on process privileges, PHP and web server rules, filesystem isolation, and Joomla deployment architecture; no evidence confirms access to other hosts or privilege escalation.

Successful exploitation could let an attacker execute code with the permissions of the web-serving process, subject to server and filesystem configuration. Possible consequences include unauthorized changes to Joomla content or files, exposure of data accessible to that process, and service disruption. Writing a file into a public media directory could also create malicious content that is served publicly. The evidence does not confirm host-wide impact, access to other systems, or privilege escalation beyond the affected process.

1. Upgrade YOOtheme Pro to 5.0.53, which the YOOtheme vendor changelog identifies as fixing unauthenticated remote code execution via the image handler.
2. Verify the installed version on every Joomla site and confirm that the update completed, particularly on sites exposing the public image transformation handler.
3. If an immediate update is not possible, the available evidence provides no separate vendor workaround. Deployment-specific compensating controls may limit unauthenticated access to the image handler or prevent server-side execution in public media directories, but they do not replace the fix.
4. If suspicious files or code execution are found, treat the site as a security incident and preserve logs and artifacts for investigation before cleanup. Release branches not covered by the available evidence require separate verification.

1. Inventory Joomla sites and identify deployments that install YOOtheme Pro.
2. Check the deployed version on each site and compare it with the affected and fixed boundaries in affected_summary; verify that the remediated release is actually installed.
3. Review application and web server logs for unauthenticated requests to the image transformation handler, especially reuse of one signature with changed image operations or output destinations, traversal-like destination values, or writes outside the expected cache location. Treat these as investigative leads, not confirmed vendor IOCs.
4. Inspect public media directories and cache storage for unexpected newly created files, particularly files combining PNG content with PHP or files treated as executable by the server.
5. Where available, review file-integrity and process telemetry for server-side execution originating from public media locations. Absence of log or file evidence does not prove that a system is safe.