In recent months, several vulnerabilities have been discovered in both Joomla third-party extensions and the Joomla core itself. We received on 12th July 2026 a report of a security issue affecting DPCalendar, which we document here.
Today, we are releasing the following update:
The next chapter describes some more details about the vulnerability in DPCalendar which exists since version 8.18.0 and affects Joomla 3 installations as well. If you are running DPCalendar 9.x, please update to version 10.0.0 then to version 10.6.0 and then to 10.11.2.
Blind SQL injection
By sending a speciall URL to a JSON endpoint of the events view with an author query parameter, an attacker can exploit a blind SQL injection vulnerability to query data from the Joomla database without authentication. Because this is a blind SQL injection, the actual database contents are not returned in the HTTP response. Instead, the attacker must infer the data by sending carefully crafted requests that test whether a specific condition is true or false, for example, whether a particular character at a given position matches a specific value. As a result, data must be extracted one character at a time. For each character, multiple requests are typically required until the correct value is identified. This makes the extraction process slow and resource-intensive, especially for larger datasets. In our internal testing, a proof-of-concept script required more than two minutes to extract meta information about the database and a single user record from our demo site. Extracting larger amounts of data would take considerably longer and require a significant number of requests.
It is NOT possible to modify any data in the database. Extracting a complete Joomla database therefore requires a large number of requests. Despite these limitations, the vulnerability allows unauthenticated attackers to read sensitive data from the database, which classifies it as High severity and not critical (which would lead to full system compromise). For this reason, we are releasing a security update outside of our regular Thursday release schedule.
Is my system compromised?
Your files on the server are safe. This vulnerability cannot be used to take control of your website because it does not allow files to be modified, uploaded, or deleted. The vulnerability allows an unauthenticated attacker to read data from the Joomla database, but it does not provide the ability to upload malicious files, execute arbitrary code, or gain remote control of your Joomla website.
Can't update
If for some reasons (old Joomla version, core hacks) it is not possible to update DPCalendar, you can modify the vulnerable file manually and apply the patch by directly editing the file /components/com_dpcalendar/src/Model/EventsModel.php with the change from here.
Update not found
Joomla had a nasty bug, where updating multiple extensions at once resulted in a removal of packages, it might be possible that the DPCalendar package got uninstalled in a previous version. Please double check if the package is correctly installed, if not, then install it manually and set the download ID again in the update source. The fix in Joomla was shipped recently with version 5.4.7 and 6.1.2.
Firewall or security extensions
Sadly we made some tests on systems with web application firewalls or Joomla security extensions and none could detect the vulnerability and block access to it out of the box.
Credits
A huge shoutout to Phil Taylor from mysites.guru for spotting the bug and helping every step of the way to get the fix shipped. If you're looking for an easy way to manage Joomla sites, give mysites.guru a try. It keeps your sites updated and monitored from a single dashboard, quietly working in the background so you can focus on what matters most, your clients.
Conclusion
This is the first security vulnerability reported in DPCalendar since its initial release in 2012. While we are grateful that the issue was identified and responsibly disclosed, we deeply regret any concern or inconvenience it may have caused. Security has always been a top priority for DPCalendar by using the core security best practices, and we take reports like this very seriously. We responded as quickly as possible by investigating the issue, developing a fix, and making updates available to affected users within 24 hours, even on holiday. We remain committed to continuously improving our development and security processes to reduce the risk of similar issues in the future. Thank you for your trust and understanding.
Kind regards
Allon Moritz aka laoneo
Founder of Digital Peak