Joomla Cms CVE-2026-23898

Attacker must have high-privilege administrative access to the autoupdate server mechanism. Requires the autoupdate service to be enabled and accessible. No victim interaction needed. Affects systems with unvalidated file path input in autoupdate functionality.

While CVSS score and vector are not available, the vulnerability exhibits high real-world risk based on multiple factors: (1) the attack vector is remote and likely requires low or no privileges, given the nature of autoupdate mechanisms which are often accessible without authentication; (2) arbitrary file deletion can directly impact availability and system integrity, potentially disabling the application or the host system; (3) the simplicity of input validation flaws (CWE-73) typically results in straightforward exploitation; (4) Joomla!'s widespread deployment in production environments amplifies impact. The lack of CVSS quantification does not diminish priority-this is a concrete functional vulnerability with clear security consequences. EPSS data not provided, but exploitation probability should be considered moderate-to-high given the directness of the flaw and the public disclosure through an official security advisory.

An attacker sends a crafted request to the Joomla! autoupdate mechanism (com_joomlaupdate) containing a manipulated file path parameter. Due to insufficient input validation, the component processes the malicious path and deletes a critical file such as a core system file, a configuration file, or a database backup. This could render the Joomla! installation inoperative or corrupt application state. If combined with other vulnerabilities or weak file permissions, the attacker could strategically delete files to escalate privileges or enable secondary exploitation.