CVE-2026-23898 HIGH

CVE-2026-23898: Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate

Vendor Joomla! Project
Product Joomla! CMS
Weakness CWE-73
Published April 1, 2026
Last update April 2, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

Explanation of Vulnerability in Simple Terms

02Summary

A high-privilege vulnerability in Joomla! CMS 4.0.0 through 5.4.3 allows authenticated administrators to read sensitive data on the site. The vulnerability requires an admin account and network access but does not require user interaction. Site administrators should update to a version newer than 5.4.3 as soon as a patch is available.

What an attacker can do

03Attacker Capabilities

Read sensitive data on the Joomla site if they have administrator privileges.

Potential impact on your site

04Site Impact

An admin account holder can access confidential information; monitor admin accounts and restrict access to trusted users only.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the Joomla site.

Key dates

06Disclosure timeline

April 1, 2026 CVE published
April 2, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-10058 WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2025-4603 eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Deletion CVE-2025-11973 简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read CVE-2025-5393 Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion CVE-2026-8095 Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion