What the vulnerability does
01Description
Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.
CVE-2026-23898
HIGH
CVE-2026-23898: Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
CVSS base score
8.6/10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Explanation of Vulnerability in Simple Terms
02Summary
A high-privilege vulnerability in Joomla! CMS 4.0.0 through 5.4.3 allows authenticated administrators to read sensitive data on the site. The vulnerability requires an admin account and network access but does not require user interaction. Site administrators should update to a version newer than 5.4.3 as soon as a patch is available.
What an attacker can do
03Attacker Capabilities
Read sensitive data on the Joomla site if they have administrator privileges.
Potential impact on your site
04Site Impact
An admin account holder can access confidential information; monitor admin accounts and restrict access to trusted users only.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the Joomla site.
Key dates
06Disclosure timeline
April 1, 2026
CVE published
April 2, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2021-24966 Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing
CVE-2025-0898 Xpro Elementor Addons - Pro <= 1.4.7 - Authenticated (Contributor+) Arbitrary File Read via Draw SVG
CVE-2025-9048 Wptobe-memberships <= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion
CVE-2025-11973 简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read
CVE-2025-3419 Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read
