CVE-2026-48906 - Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla · CoreCVE

Back Back to CVE browser

CRITICAL

Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla

Published May 27, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.38%

Description

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Affected products

Vendor Tassos.gr Product Advanced Custom Fields Default
unaffected
- Version
  1.0.0-2.8.12
  Status
  affected
  Constraints
  -
- Version
  3.0.0-3.1.3
  Status
  affected
  Constraints
  -
Vendor Tassos.gr Product Convert Forms Default
unaffected
- Version
  1.0.0-4.4.12
  Status
  affected
  Constraints
  -
- Version
  5.0.0-5.1.5
  Status
  affected
  Constraints
  -
Vendor Tassos.gr Product EngageBox Default
unaffected
- Version
  1.0.0-6.3.11
  Status
  affected
  Constraints
  -
- Version
  7.0.0-7.1.1
  Status
  affected
  Constraints
  -
Vendor Tassos.gr Product Google Structured Data Default
unaffected
- Version
  1.0.0-5.6.11
  Status
  affected
  Constraints
  -
- Version
  6.0.0-6.1.9
  Status
  affected
  Constraints
  -
Vendor Tassos.gr Product MailChimp Auto-Subscribe Default
unaffected
- Version
  1.0.0-5.0.5
  Status
  affected
  Constraints
  -
- Version
  5.1.0-5.2.0
  Status
  affected
  Constraints
  -
Vendor Tassos.gr Product Novarain/Tassos Framework (plg system nrframework) Default
unaffected
- Version
  1.0.0-6.0.1
  Status
  affected
  Constraints
  -
Vendor Tassos.gr Product Smile Pack Default
unaffected
- Version
  1.0.0-1.2.6
  Status
  affected
  Constraints
  -
- Version
  2.0.0-2.1.0
  Status
  affected
  Constraints
  -
Vendor Tassos.gr Product Tassos Code Snippets Default
unaffected
- Version
  1.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Advanced Custom Fields

unaffected

Version	Status	Constraints
1.0.0-2.8.12	affected	-
3.0.0-3.1.3	affected	-

unaffected

Version	Status	Constraints
1.0.0-4.4.12	affected	-
5.0.0-5.1.5	affected	-

unaffected

Version	Status	Constraints
1.0.0-6.3.11	affected	-
7.0.0-7.1.1	affected	-

Google Structured Data

unaffected

Version	Status	Constraints
1.0.0-5.6.11	affected	-
6.0.0-6.1.9	affected	-

MailChimp Auto-Subscribe

unaffected

Version	Status	Constraints
1.0.0-5.0.5	affected	-
5.1.0-5.2.0	affected	-

Novarain/Tassos Framework (plg system nrframework)

unaffected

Version	Status	Constraints
1.0.0-6.0.1	affected	-

unaffected

Version	Status	Constraints
1.0.0-1.2.6	affected	-
2.0.0-2.1.0	affected	-

Tassos Code Snippets

unaffected

Version	Status	Constraints
1.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32162
Advisory
https://tassos.gr
product

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32162		Advisory
https://tassos.gr		product

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Joomla

Published May 27, 2026

Updated Jun 5, 2026

Reserved May 26, 2026

Link CVE-2026-48906

CISA Vulnrichment

Updated May 27, 2026

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-48906

Severity n/a

Public date n/a

Links CVE-2026-48906

Assigner Joomla

Published May 27, 2026

Updated Jun 5, 2026

Exploited since n/a

Link EUVD-2026-32162

EUVD-2026-32162