Phoca Commander CVE-2026-66492

Q: What is the CVSS score of CVE-2026-66492?

CVE-2026-66492 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54411 MEDIUM

Path Traversal (CWE-22)

2026-08-07 Joomla

GHSA-7c99-cx95-2fcq

File Upload Path Traversal Phoca Commander Extension For Joomla

6.1

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

PR:H reflects mandatory admin authentication; S:C and I:H capture filesystem writes outside Joomla webroot boundary; no confidentiality or availability impact described.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 09:21 vuln.today

DescriptionCVE.org

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.

AnalysisAI

Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.

Technical ContextAI

Phoca Commander is a file management extension for the Joomla CMS, identified by CPE cpe:2.3:a:phoca.cz:phoca_commander_extension_for_joomla:*:*:*:*:*:*:*:*. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'): the file upload action accepts user-controlled path components without sufficient canonicalization or boundary enforcement. An attacker supplying sequences such as '../' in the upload destination path can cause the server to resolve a location outside the configured upload directory. Because Phoca Commander operates as a server-side file manager with native filesystem access, path traversal here has direct write-to-disk consequences rather than merely redirecting a file read.

RemediationAI

Check the official Phoca Commander vendor page at https://www.phoca.cz/phocacommander for a patched release and upgrade to the latest available version above 6.1.3. Patch availability per vendor advisory is indicated but an exact fix version is not independently confirmed from the provided data - verify the release changelog before upgrading. If an immediate upgrade is not feasible, restrict access to the Phoca Commander extension to the minimum necessary set of Joomla administrators, review Joomla administrator account security (enforce MFA), and consider temporarily disabling the file upload feature within the extension's configuration if the plugin supports it. Monitor server-side upload directories and adjacent paths for unexpected file creation as a detective control. Disabling the extension entirely is a viable zero-risk workaround with the trade-off of losing file management capability.