YOOtheme ZOO CVE-2026-74803 and CVE-2026-74804: update to 4.1.66

YOOtheme fixed two critical ZOO vulnerabilities on 19 August 2026: an unauthenticated arbitrary file upload and an unauthenticated SQL injection. ZOO 4.1.64 closed those paths, but 4.1.65 and 4.1.66 added more security fixes. For an internet-facing Joomla site, update directly to 4.1.66 or later.

Short answer: update now

The affected code is reachable without authentication. That makes the two issues materially different from vulnerabilities that require an administrator account. The Joomla Project assigned CVSS 4.0 scores of 10.0 to CVE-2026-74803 and 9.3 to CVE-2026-74804.

CVE-2026-74803: unauthenticated arbitrary file upload

NVD describes the affected range as ZOO 1.0.0 through 4.1.63. In the vulnerable image element, a client-supplied Content-Type inside the image MIME group could allow an arbitrary file to pass the upload check.

• No Joomla account is required.
• The weakness is classified as unrestricted upload of a dangerous file type (CWE-434).
• A successful upload can affect confidentiality, integrity and availability, which is why the Joomla Project score is critical.

Do not turn this description into a filename-only search. Review all writable submission and media locations, including files with misleading extensions, unexpected modification times and PHP or script content where it should never exist.

CVE-2026-74804: unauthenticated SQL injection

NVD identifies the vulnerable code path in ItemController::element(). The request values used for item type filters were inserted into a database query without correct quoting or escaping. The affected range is again ZOO 1.0.0 through 4.1.63.

• No authenticated session is required.
• The weakness is SQL injection (CWE-89).
• The potential technical impact includes reading or changing database data.

After patching, inspect administrator accounts, recently changed content and extensions, unfamiliar scheduled tasks and database records that influence templates or executable content.

Why update to ZOO 4.1.66

ZOO 4.1.64 fixed CVE-2026-74803 and CVE-2026-74804. Version 4.1.65 then added administrator ACL protection for tag management. Version 4.1.66 added further fixes for path traversal, cross-site scripting, external redirects and CSRF, and tightened upload and import validation.

Use the vendor package and confirm the installed version after the update. Do not rely only on an update notification appearing in Joomla.

Update and investigation checklist

1. Preserve a copy of site files, the database and access logs before cleanup.
2. Restrict public access or use a safe maintenance mode while investigating.
3. Update ZOO to 4.1.66 or later and verify the version in the administrator area.
4. Review frontend submissions, upload directories and recently modified files.
5. Inspect administrator and editor accounts, database changes, cron jobs and other persistence points.
6. If anything suspicious is found, rotate hosting, CMS, FTP/SSH and database credentials.
7. Recheck after 24 hours and again after 7 days.

CISA's ADP record showed no confirmed exploitation for these CVEs on 20 August, while also marking the issues as automatable. That is a point-in-time status, not evidence that an exposed site is safe.

Check the public-facing site

This external check can spot visible defacement, redirects, cloaking and some version signals. It cannot inspect the filesystem or database, so use it as a first screen rather than proof of a clean installation.

Primary sources

• YOOtheme ZOO changelog
• NVD: CVE-2026-74803
• NVD: CVE-2026-74804