CVE-2026-94131 – Joomla Extension – acymailing.com – Unauthenticated arbitrary file deletion in AcyMailing

Joomla Extension – acymailing.com – Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 – A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.