A maximum-severity flaw in the YOOtheme Pro Joomla template lets an unauthenticated visitor write executable code into a public media folder, and sites are already showing signs of it. Updating to 5.0.53 closes the hole but does not remove what an attacker may have left behind.
What happened
CVE-2026-102785 is scored 10.0 by the Joomla project as CNA, affecting YOOtheme Pro 5.0.0 through 5.0.52. The vulnerable component is the publicly reachable image transformation handler that resizes and crops images on the fly, so it is reachable by any visitor with no login at all.
The handler binds the image operations and the output destination to a request signature, but does it incompletely. An attacker can take a signature that is disclosed in a legitimate public image URL, attach extra image operations to it, and traverse out of the intended cache directory. The result is an attacker-controlled PNG/PHP polyglot written into a media directory that the web server will execute.
YOOtheme's own support forum carries reports from site owners who found files that are genuine JPEG images, complete with gd-jpeg creator metadata at quality 80, with PHP code hidden inside that metadata. The hidden code is a password-protected backdoor, which means the site keeps working normally while someone else holds a key to it.
Who is affected
Any Joomla site running YOOtheme Pro between 5.0.0 and 5.0.52. This is a commercial template used heavily by small agencies and by businesses that bought a theme once and never revisited it.
- Sites on YOOtheme Pro 5.0.53 or later are patched against this flaw.
- Sites on the older 2.x and 4.x branches are not covered by this CVE but have separate, lower-rated issues of their own.
- Any site that was exposed on an affected version should be treated as possibly compromised, whether or not it shows symptoms.
- Sites with a Web Application Firewall in front are not automatically safe: the request is a normal-looking image URL.
What to do now
Update to YOOtheme Pro 5.0.53 immediately, then search the site for polyglot files before you assume the job is finished. A patched site with a backdoor still in the media folder is still owned.
- Update the template to 5.0.53 and clear the Joomla cache afterwards.
- Scan the media and images directories, including cache subfolders, for files that are images by extension but contain PHP opening tags. Checking EXIF and comment metadata matters as much as checking the file body.
- Review web server logs for image URLs carrying unexpected parameters or repeated signature values reused across many requests.
- Reset Joomla super-user passwords, Joomla API tokens and any FTP or SSH credentials the site holds, then rotate database passwords.
- If anything suspicious is found, restore the site from a backup taken before the compromise and re-apply updates on the clean copy rather than cleaning in place.
What this means for South African businesses
Joomla sites built on commercial templates are common among South African SMEs, and they are usually maintained by whoever built them years ago, on a support arrangement that ended. A 10.0 unauthenticated flaw in that stack is not a theoretical problem for a business whose website sits on the same hosting account as its mail and its customer portal.
My judgement is that the patching is the easy half here. The backdoors described on YOOtheme's forum are designed to survive an update, so an SME that patches and moves on will believe it is clean while the access remains.
Source
GitHub Advisory Database, GHSA-8w8j-f6ph-29mm: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.