Path traversal in Clear Cache (EGSA-2026-01, severity 6.5). menu:Event Gallery[Clear Cache] took the name of the cache folder to empty from the request and did not check where it led. A back-end user with the permission to manage Event Gallery - in Joomla’s default permissions every Administrator, not only a Super User - could make it delete any folder the web server may write to, up to the whole site. It now only empties a folder which lies directly in the image cache.

Cross-site scripting and open redirect on the front-end upload page (EGSA-2026-02, severity 6.1). The btn:[Back] link of the upload page of the front end took its target from the address of the page and printed it as it came. A prepared link could therefore make it point to another web site, or run a script in the session of the editor who opened it. The link now only leads to a page of your own site, and there is none when the address names anything else.

Forged uploads (EGSA-2026-03, severity 5.4). Uploading a file did not check the security token, neither in the back end nor in the front end, so a prepared page on another web site could make a logged in editor upload a file into an event - and replace a file of the same name there. The upload now needs the token.

Forged clean-up in the back end (EGSA-2026-05, severity 4.3). The two clean-up links on the overview page of the backend, which remove orphaned files and old carts from the database, now carry Joomla’s form token. Before, a prepared link on another website could have triggered them while you were logged in to the backend.

If you have a template override of the upload page of the back end (upload/default.php of com_eventgallery in your administrator template), or an override of the upload page of the front end which copied that markup instead of including the file of the back end, bring it up to date: the address in the attribute data-upload-url of the element #uploader now carries the security token. With an old override every file is refused with the message about an invalid security token.

If you have a template override of upload/default.php of the front end, it gets the checked target of the btn:[Back] link from the view; take over the escaping of the link from the new file.