CVE-2026-66914 CRITICAL

CVE-2026-66914: Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1

Vendor Seblod.com
Product SEBLOD extension for Joomla
Weakness CWE-22 · Path traversal
Published August 7, 2026
Last update August 7, 2026
View on NVD All CVEs

CVSS base score

9.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot.

Explanation of Vulnerability in Simple Terms

02Summary

The SEBLOD extension for Joomla contains a path traversal vulnerability that allows an attacker to read arbitrary files from the server. An unauthenticated attacker can exploit this over the network without user interaction by crafting a malicious request. This could expose sensitive configuration files, database credentials, or other private data stored on the web server.

What an attacker can do

03Attacker Capabilities

Read arbitrary files from the server, including configuration files and sensitive data.

Potential impact on your site

04Site Impact

Attackers can access sensitive files like database credentials, configuration settings, and private user data.

Conditions required to exploit

05Prerequisites

Network access to the Joomla site; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 7, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-14500 Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action CVE-2026-11911 Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter CVE-2026-8442 WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter CVE-2026-65878 Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1