CVE-2026-66493 MEDIUM

CVE-2026-66493: Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Vendor Phoca.cz
Product Phoca Commander extension for Joomla
Weakness CWE-22 · Path traversal
Published August 7, 2026
Last update August 10, 2026
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.

Explanation of Vulnerability in Simple Terms

02Summary

Phoca Commander for Joomla contains a path traversal vulnerability that allows authenticated administrators to read or modify files outside the intended directory. An attacker with high-level admin privileges can navigate the file system using specially crafted paths. This affects versions 1.0.0 through 6.1.3. Update to a version newer than 6.1.3 when available.

What an attacker can do

03Attacker Capabilities

Read or modify files outside the intended directory on the server.

Potential impact on your site

04Site Impact

A compromised admin account could expose sensitive files or alter site configuration and data.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrator privileges in Joomla.

Key dates

06Disclosure timeline

August 7, 2026 CVE published
August 10, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-11426 UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension CVE-2026-14327 AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter CVE-2026-57709 WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability