Joomla! CMS CVE-2026-40384

Q: What is the CVSS score of CVE-2026-40384?

CVE-2026-40384 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31885 MEDIUM

Path Traversal (CWE-22)

2026-05-26 Joomla

GHSA-hr66-rv65-f5r4

Path Traversal Joomla Cms

5.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:33 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

5.9 (MEDIUM)

CVE Published

May 26, 2026 - 16:45 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

AnalysisAI

Path traversal in Joomla! CMS com_media web service endpoint allows authenticated high-privilege attackers to read arbitrary files outside the intended web root via a manipulated search parameter. Affected versions span two major release trains: 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. No public exploit code exists and no active exploitation has been confirmed, but the vulnerability results in full confidentiality loss of the vulnerable system's filesystem contents accessible to the web process.

Technical ContextAI

The com_media component in Joomla! CMS exposes a REST API endpoint for managing media files. The vulnerable code path fails to properly validate or sanitize the 'search' parameter submitted to this endpoint, allowing CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) exploitation - commonly known as path traversal. By injecting directory traversal sequences (e.g., '../') into the search parameter, an attacker can cause the application to resolve file paths outside the intended media directory, exposing arbitrary server-side files readable by the web process. The affected CPE is cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*, spanning both the 4.x/5.x and 6.x release lines. The CVSS 4.0 vector (AT:P) confirms that specific attack requirements beyond basic network access must be met, consistent with the PR:H requirement - a privileged CMS account.

RemediationAI

The primary remediation is to upgrade to a patched release of Joomla! CMS. Consult the Joomla Security Centre advisory at https://developer.joomla.org/security-centre/1042-20260510-core-path-traversal-in-com-media-webservice-endpoint.html for the exact fixed versions - an exact patched version number is not independently confirmed from the available input data, so administrators should verify the latest stable releases in the 5.x and 6.x branches directly from joomla.org. As a compensating control prior to patching, restrict access to the com_media API endpoint at the web server or WAF layer by blocking requests containing traversal sequences (e.g., '../', '%2e%2e') in the search parameter; note this may break legitimate media search functionality. Additionally, applying the principle of least privilege by auditing and reducing the number of Super User and Administrator accounts minimizes the pool of identities capable of triggering the vulnerability, since PR:H is required. Ensure web process file system permissions are scoped to the web root to limit the blast radius of any successful traversal.