Hello Kris,

First, your iCagenda installation on your Joomla 3 is "safe": it has no critical security issue (but your Joomla 3 installation is maybe not so safe as end of life...).

Only Joomla 6 from 6.0.0 to 6.1.1 has a critical security issue on attachment uploads (this is fixed in Joomla 6.1.2).

That means iCagenda running on all older versions prior to Joomla 6 (and all J6 version since 6.1.2) don't have a critical vulnerability.

The only common issue is the possibility to submit a not-approved event in guest access. The result is "fake" event added to the list of events, not visible on public frontend, but in admin, and with no possibility to exploit it.
So, more annoying than anything.

About your pro version, the version 3.6.6 is really old. If you don't have anymore an active pro subscription, so you can't update to pro.
If you want to install the free version over a pro version, then you will have first to remove the pro module (iC Event List) and the pro plugins, as it's using old code from 3.6.6 (December 2016... 10 years ago) may not run with component code from 2026...
This is like installing a core component of Joomla 6 on a Joomla 3 site, it will crash.

Another solution, if you want to keep the pro feature of iCagenda Pro, is to renew your subscription...

Best regards,
Cyril

Hello,

Yes it's a security release as it adds a few security improvements.
When i released it, i was still investigating about why this issue happened, and i was not yet sure the critical issue was only on Joomla 6.0.0 to 6.1.1 due to a change (regression) in the Joomla framework (fixed in Joomla 6.1.2).

At least, 3.9.15 is blocking the submission of events from frontend in guest access (even if events were not approved and not visible in the frontend, this was an annoying issue for users. And even if not exploitable, it's is still a security fix as what is not supposed to be allowed should not be allowed).

In all cases, it's always better to keep a Joomla up-to-date as well as all extensions installed. And when an extension development is abandonned, it's better to find as soon as possible another extension to replace it.

Another recommendation is to full uninstall extensions that are not anymore used.

But as you're on Joomla 3, my first recommendation would be to clean your site of what not used, and upgrade to J4 and then J5 at minimum.

With AI, web and computer faster, the bots build to hack websites (all type of platforms are concerned), it's important more than ever to keep your own website up-to-date, protected and to do regularly backups.

I know upgrade from J3 to J4 is not easy, but after that, upgrade from J4 to J5 to J6 and later is much more easy than ever! (which was the goal of the massive code structure change in Joomla 4).

Best regards,
Cyril

mark_12 wrote:

"The only common issue is the possibility to submit a not-approved event in quest access. The result is "fake" event added to the list of events, not visible on public frontend, but in admin, and with no possibility to exploit it."

How can I fix it? Simply update icagenda?
But aren't there any php files or traces of the attack left in the database? Does anyone have any idea if, and if so, which malicious files remain in the module files even after the update?
 

Hello Mark,
Yes, just update.
If your site was not on Joomla 6.0.0 to 6.1.1 before update of iCagenda, you don't have to worry about iCagenda. No file could be uploaded.
As i've explained already in the blog article: www.joomlic.com/news/icagenda-security-update
And in my previous message here: forum.joomlic.com/icagenda-help-en/4921-cve-2026-48939#19098

If you have suspicious files (php or else) in your Joomla install, this is not due to iCagenda, so better to invest if it's not due to another extension, or if on an old not supported Joomla version (like Joomla 3 and 4).

Best regards,
Cyril