vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-48906

Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla

HIGH
8.1
CVSS Score
Published: May 27, 2026 at 09:11 AM UTC
Updated: October 14, 2026 at 08:10 PM UTC
16 products affected across 2 vendorsTassos Code SnippetsGoogle Structured DataMailchimp Auto Subscribe

Using Novarain/Tassos Framework (plg_system_nrframework) by tassos.gr?

Get instant alerts when new vulnerabilities affect Novarain/Tassos Framework (plg_system_nrframework) - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Advanced Custom Fields· Tassosjoomla
95%
1.0.0 ≤ v ≤ 2.8.123.0.0 ≤ v ≤ 3.1.3
Convert Forms· Tassosjoomla
95%
1.0.0 ≤ v ≤ 4.4.125.0.0 ≤ v ≤ 5.1.5
Engagebox· Tassosjoomla
95%
1.0.0 ≤ v ≤ 6.3.117.0.0 ≤ v ≤ 7.1.1
Google Structured Data· Tassosjoomla
95%
1.0.0 ≤ v ≤ 5.6.116.0.0 ≤ v ≤ 6.1.9
Mailchimp Auto Subscribe· Tassosjoomla
95%
1.0.0 ≤ v ≤ 5.0.55.1.0 ≤ v ≤ 5.2.0
Smile Pack· Tassosjoomla
95%
1.0.0 ≤ v ≤ 1.2.62.0.0 ≤ v ≤ 2.1.0
Tassos Code Snippets· Tassosjoomla
95%
1.0.0
Tassos Framework· Tassosjoomla
95%
1.0.0 ≤ v ≤ 6.0.1
Advanced Custom Fields· Tassos Gr
90%
1.0.0-2.8.123.0.0-3.1.3
Convert Forms· Tassos Grjoomla
90%
1.0.0-4.4.125.0.0-5.1.5

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Product
Source: cverecord
https://tassos.gr

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.1HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-284NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card