What the vulnerability does
01Description
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
CVE-2026-40383
HIGH
CVE-2026-40383: Joomla! Core - [20260509] - LFI in HTMLView layout parameter
CVSS base score
7.5/10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Explanation of Vulnerability in Simple Terms
02Summary
A path traversal vulnerability in Joomla! CMS versions 3.2.1 through 5.4.5 allows authenticated administrators to read or access files outside the intended directory structure. An attacker with high-level administrative privileges can exploit this by crafting malicious file paths. This vulnerability requires network access and administrator credentials to exploit.
What an attacker can do
03Attacker Capabilities
Read or access files outside the intended directory on the server.
Potential impact on your site
04Site Impact
An administrator account compromise could expose sensitive files on your server outside the web root.
Conditions required to exploit
05Prerequisites
Attacker must have high-level administrator credentials and network access to the Joomla site.
Key dates
06Disclosure timeline
May 26, 2026
CVE published
May 27, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-6320 Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path Traversal
CVE-2026-48866 WordPress Gravity Forms plugin <= 2.10.0.1 - Arbitrary File Deletion vulnerability
CVE-2018-25326 Google Drive for WordPress 2.2 Path Traversal RCE via gdrive-ajaxs.php
CVE-2026-9197 Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
CVE-2026-13369 Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
