Riskcovery

CVE-2026-48906

Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla

State
Published
Severity
9.3 Critical
Published
May 27, 2026
Updated
Jun 5, 2026
Reserved
May 26, 2026

Read the record on cve.org

Description

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Scores

CVSSScoreVectorSource
4.09.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/AU:YJoomla

Weaknesses

Affected Products

ProductVersions
Novarain/Tassos Framework (plg_system_nrframework)tassos.gr
  • 1.0.0-6.0.1Affected
Convert Formstassos.gr
  • 1.0.0-4.4.12Affected
  • 5.0.0-5.1.5Affected
EngageBoxtassos.gr
  • 1.0.0-6.3.11Affected
  • 7.0.0-7.1.1Affected
Google Structured Datatassos.gr
  • 1.0.0-5.6.11Affected
  • 6.0.0-6.1.9Affected
Advanced Custom Fieldstassos.gr
  • 1.0.0-2.8.12Affected
  • 3.0.0-3.1.3Affected
Smile Packtassos.gr
  • 1.0.0-1.2.6Affected
  • 2.0.0-2.1.0Affected
Tassos Code Snippetstassos.gr
  • 1.0.0Affected
MailChimp Auto-Subscribetassos.gr
  • 1.0.0-5.0.5Affected
  • 5.1.0-5.2.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.