Phoca Commander CVE-2026-65765

Q: What is the CVSS score of CVE-2026-65765?

CVE-2026-65765 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-49128 MEDIUM

Path Traversal (CWE-22)

2026-07-27 Joomla

GHSA-c8m7-7389-gq73

Path Traversal Phoca Commander Extension For Joomla Phoca Cz

6.9

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Requires high privileges (admin), scope changed (reads server files), confidentiality only.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 09:20 vuln.today

DescriptionCVE.org

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.

AnalysisAI

Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.

Technical ContextAI

The vulnerability is a classic path traversal (CWE-22) affecting Phoca Commander, a Joomla extension for file management. The CPE entry cpe:2.3:a:phoca.cz:phoca_commander_extension_for_joomla:*:*:*:*:*:*:*:* confirms the affected software. The root cause is improper sanitization of user-supplied paths in file save and download operations, enabling attackers with high privileges to access files outside the intended directory.

RemediationAI

No vendor-released patch is identified from the available intelligence. Users should check the Phoca Commander official website (https://www.phoca.cz/phocacommander) for any updates. As a workaround, restrict administrator access to only trusted personnel, disable unused file management features, and implement web application firewall rules to block path traversal patterns (e.g., '..' sequences). Limiting admin panel access may reduce attack surface but could impact normal administrative workflows.