Unauthenticated path traversal in SEBLOD Joomla extension (CVE-2026-66914)

An unauthenticated path traversal vulnerability exists in the SEBLOD extension for Joomla. An unauthenticated attacker could exploit this flaw to download arbitrary files from both inside and outside the web root, potentially exposing sensitive server-side data. Affected versions: - SEBLOD < 3.30.0 - SEBLOD < 4.7.0 - SEBLOD < 6.0.1 We recommend updating to: 3.30.0, 4.7.0, 6.0.1. CVSS 9.2 · our assessment: act_now Reference: https://www.seblod.com/ Details: https://vuln.today/cve/CVE-2026-66914