Joomla Cms CVE-2026-23898

Q: What is the CVSS score of CVE-2026-23898?

CVE-2026-23898 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17861 HIGH

External Control of File Name or Path (CWE-73)

2026-04-01 Joomla

GHSA-m9qp-xh66-cmcx

Information Disclosure Joomla Cms

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 10:00 euvd

EUVD-2026-17861

Analysis Generated

Apr 01, 2026 - 10:00 vuln.today

CVE Published

Apr 01, 2026 - 09:03 nvd

HIGH 8.6

DescriptionCVE.org

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

AnalysisAI

Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote attackers to delete files on affected servers due to insufficient input validation. The vulnerability affects all versions of Joomla! CMS through the update component and carries moderate-to-high real-world risk because file deletion can compromise system integrity, availability, and potentially enable privilege escalation or secondary attacks when combined with other weaknesses.

Technical ContextAI

The vulnerability resides in the Joomla! Update (com_joomlaupdate) component, which handles automatic system updates via a dedicated autoupdate server mechanism. The root cause is classified as CWE-73 (External Control of File Name or Path), indicating that the component fails to properly validate or sanitize user-supplied input before using it in file system operations. Without proper input validation, an attacker can craft malicious requests to the autoupdate mechanism that cause the server to delete arbitrary files from the filesystem, rather than restricting deletion to intended temporary or cache files. This weakness in path validation allows traversal or manipulation of file references beyond the intended scope.

RemediationAI

Apply the security patch released by the Joomla! Project as documented in their official Security Centre advisory (https://developer.joomla.org/security-centre/1031-20260305-core-arbitrary-file-deletion-in-com-joomlaupdate.html). The patch adds proper input validation to the com_joomlaupdate component to sanitize and restrict file paths used in deletion operations. Administrators should immediately update to the patched version available through the Joomla! update mechanism or download it directly from the official Joomla! website. As a temporary workaround prior to patching, consider restricting network access to the autoupdate mechanism if it is not actively required, or implementing file-level access controls to limit the impact of potential file deletion attempts.