What is the CVSS score of CVE-2026-65943?

CVE-2026-65943 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of RO CSVI are affected by CVE-2026-65943?

The RO CSVI (CSV Improved) extension for Joomla contains an access-control flaw allowing unauthenticated remote attackers to create arbitrary directories on affected servers.

How to fix or mitigate CVE-2026-65943?

Within 24 hours, audit all Joomla instances to identify RO CSVI deployments and assess network exposure. Within 7 days, either uninstall the CSVI extension entirely or, if business requirements mandate retention, restrict access to the import/export functionality via Web Application Firewall rules and apply restrictive file-system permissions to prevent directory creation. Within 30 days, establish vendor monitoring for a security patch release; if no patch is released within 60 days, evaluate replacement with a patched alternative solution or request extended support options from the vendor.

RO CSVI CVE-2026-65943

EUVD-2026-50308 HIGH

Improper Access Control (CWE-284)

2026-07-29 security@joomla.org

GHSA-m78x-gfg6-5j3r

Authentication Bypass Ro Csvi

7.5

CVSS 3.1 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network reachability gives AV:N/AC:L/PR:N/UI:N; 'directory creation' is a limited filesystem write, so I:L with C:N and A:N, contradicting the input's C:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 16:23 vuln.today

CVSS changed

Jul 29, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jul 29, 2026 - 13:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 13:19 cve.org

HIGH 7.5

DescriptionCVE.org

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

AnalysisAI

Unauthenticated directory creation in the RO CSVI (CSV Improved) import/export extension for Joomla affects all versions from 1.0.0 through 9.11.0, allowing remote attackers with no authentication to create arbitrary directories on the server. The flaw is an access-control failure (CWE-284) tagged by the reporter as an authentication bypass, carrying a CVSS 7.5. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

RO CSVI is a commercial Joomla extension developed by rolandd.com used to import and export catalog, product, and content data via CSV/XML files for Joomla-based sites (often VirtueMart and Joomla content). The vulnerability is classed as CWE-284 (Improper Access Control): a code path - most plausibly an import/upload or file-handling endpoint - is reachable without authentication and permits an attacker to trigger creation of directories on the host filesystem. Because Joomla extensions run inside the Joomla application context, such an endpoint would typically be exposed through an index.php component task or an AJAX/upload handler that fails to enforce session or ACL checks before performing filesystem operations.

RemediationAI

Upgrade the RO CSVI extension to version 9.11.0 or later, which is the first fixed release per the affected-range notation (< 9.11.0); obtain the update from the vendor at https://rolandd.com/products/ro-csvi and apply it through the Joomla extension updater. Until patched, restrict reachability of the vulnerable component: use web-server or Joomla-level access controls to block unauthenticated requests to the RO CSVI component endpoints (for example deny external access to its com_csvimproved import/upload tasks), place the site behind authentication or a WAF rule that rejects anonymous access to the extension, and monitor for creation of unexpected directories under the Joomla web root and tmp/media paths. The trade-off of blocking the component's endpoints is that scheduled or front-end CSV import/export automation relying on those URLs will break until the patch is applied.