CVE-2026-66491 HIGH

CVE-2026-66491: Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3

Vendor Phoca.cz
Product Phoca Commander extension for Joomla
Weakness CWE-22 · Path traversal
Published August 7, 2026
Last update August 10, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability.

Explanation of Vulnerability in Simple Terms

02Summary

Phoca Commander for Joomla contains a path traversal vulnerability that allows an attacker with high-level privileges to read files outside the intended directory. The vulnerability requires network access and high administrative privileges. An attacker can access sensitive files on the server by manipulating file paths.

What an attacker can do

03Attacker Capabilities

Read files outside the intended directory on the server.

Potential impact on your site

04Site Impact

An admin account with high privileges could be compromised to access sensitive server files.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges on the Joomla site.

Key dates

06Disclosure timeline

August 7, 2026 CVE published
August 10, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-59542 WordPress Kali Forms plugin <= 2.4.18 - Arbitrary File Deletion vulnerability CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action CVE-2026-57716 WordPress Broadcast Live Video plugin <= 7.2.4 - Arbitrary File Deletion vulnerability CVE-2026-13369 Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter CVE-2026-65582 WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability