Joomla ACL Bypass Leading to Full Site Takeover (CVE-2024-40748)

CVE-2024-40748 is an improper ACL check in Joomla CMS. Low-privilege users can escalate to super-user and upload PHP shells on Linux Apache/Nginx hosts — full site and server compromise.

Affected Joomla

• Joomla 5.0.0 through 5.0.3
• Joomla 4.0.0 through 4.4.7
• Self-hosted sites on Ubuntu, Debian, cPanel, Plesk

Check version

grep JVERSION /var/www/html/libraries/src/Version.php
php /var/www/html/cli/joomla.php --version 2>/dev/null

Patching Method

1. Backup files and database before any change.
2. Update via admin: Components → Joomla Update → install Joomla 5.1.0+ or 4.4.8+.
3. CLI update (preferred on Linux servers):

cd /var/www/html
sudo -u www-data php cli/joomla.php update:extensions --core
# or download fixed package and extract over site root (keep configuration.php)

4. Clear cache: delete administrator/cache/* and cache/*.
5. Hunt webshells: find /var/www/html -name '*.php' -mtime -14 -ls
6. Reset all super-admin passwords and review user accounts.

After patching

• Enable 2FA for all administrator accounts
• Move configuration.php outside web root if possible
• Block /administrator by IP allowlist at nginx/Apache