Security Update: Gallery and Map Fixes in Advanced Custom Fields and Smile Pack

On November 4th, 2026, we released Advanced Custom Fields 3.1.9 and Smile Pack 2.1.7, plus 2.8.16 and 1.2.10 for Joomla 3. They fix 2 security issues, one in the Gallery and one in the Map.

A customer reported the Gallery issue, and we found the Map issue ourselves. Both are fully resolved, and we coordinated them with the Joomla Security Strike Team. The issues are tracked as CVE-2026-115451 and CVE-2026-115452.

What was the issue?

Both issues live in the Tassos Framework plugin, which powers the ACF Gallery and Map fields and the Smile Pack Gallery and Map modules.

1. Gallery: deleting and seeing other people's images

The Gallery's delete request accepted a file path, and the server deleted any file inside the Gallery's folders. It needed no login. So a crafted request could remove images from other galleries, including images on published pages.

On ACF 3.1.7 and 3.1.8, all new articles also shared one folder for unsaved uploads. So users could see, remove or save each other's pending images.

The reach stopped at the Gallery's folders: media/acfgallery, media/spgallery or your custom Upload Folder. Files elsewhere were safe, and the request couldn't read or change any file.

What we changed: the server now deletes only files it issued a token for, and every user gets their own upload folder.

2. Map: scripts in marker labels

Map marker labels and addresses can hold HTML, like a link. The Map showed that HTML as is, so a label could run a script for anyone who opened the marker, administrators included. That's a stored cross-site scripting (XSS) flaw.

To use it, someone needed to be able to edit a marker, like an author editing an article with a Map field.

What we changed: the Map now strips anything that can run a script (<script> tags, event handlers, javascript: links and iframes) and keeps safe HTML. It does this every time the map shows, so old labels stop working as scripts as soon as you update.

Who is affected?

• Advanced Custom Fields 3.1.8 or older (2.8.15 or older on Joomla 3), with a Gallery or Map field
• Smile Pack 2.1.6 or older (1.2.9 or older on Joomla 3), with a Gallery or Map module

Our other extensions don't use these features. We rate both issues as moderate: neither one exposes your data or runs code on your server.

What you need to do

Update to the versions below, or later.

Each release ships the patched Tassos Framework. Update your other Tassos extensions too, so an older one can't bring back an older framework.

Verify your installation

• Log in to your Joomla Administrator
• Go to System → Manage → Extensions
• Confirm Advanced Custom Fields and Smile Pack match the table above
• On Joomla 4, 5 or 6, confirm Tassos Framework is 6.1.48 or later

If you can't update right away

For the Gallery, updating is the only fix.

For the Map, go to Content → Fields, open your Map field and, in Permissions, set Edit Custom Field Value to Denied for groups you don't fully trust. Change it back after you update.

Should you check anything else?

• Galleries: look for missing images. The Gallery editor marks them with File is missing. Upload them again or restore them from a backup.
• Maps: look for marker labels you didn't write, with things like <script>, onerror= or javascript:. They can't run after the update, but remove them and find out who added them.

If something worries you, open a support ticket and we'll help.

Responsible disclosure

Thank you to:

• Michael Nielsen, who reported the Gallery issue with a detailed write-up and steps to reproduce it
• The Rutgers University team, whose request for grouped map markers led us to the Map issue, and who tested our beta releases on their site
• The Joomla Security Strike Team, for coordinating the disclosure

We have no evidence that anyone used either issue against a live site.

Found a security issue in one of our extensions? Open a support ticket. We treat these reports as a priority and credit reporters in the release notes.

Security remains a top priority for us. If you need help updating, open a support ticket and we'll assist you promptly.