CVE-2013-5576

CVE-2013-5576 describes a critical arbitrary file upload vulnerability in the media manager component of Joomla! versions 2.5.x before 2.5.14 and 3.x before 3.1.5. This flaw allows remote authenticated users, or even unauthenticated attackers in some configurations, to bypass access restrictions and upload files with dangerous extensions by appending a trailing dot to the filename. With a CVSS score of 6.8, this vulnerability is easily exploitable over the network with medium attack complexity, potentially leading to partial compromise of confidentiality, integrity, and availability. The vulnerability was actively exploited in the wild in August 2013, and a Metasploit module exists, indicating readily available exploit code, despite limited community discussion or media coverage.