EUVD-2026-54409
GHSA-fcf9-29pq-pgc6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin credentials required (PR:H) over network; path traversal escapes extension sandbox to host filesystem (S:C), enabling read, overwrite, and deletion of arbitrary files.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.
AnalysisAI
Path traversal in Phoca Commander (Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 enables authenticated Joomla administrators to escape intended directory boundaries during delete, copy, and move file operations, reaching arbitrary locations on the host filesystem. The CVSS 4.0 vector confirms high subsequent-system impact (SC:H/SI:H/SA:H) with no direct impact on the extension itself, meaning successful exploitation threatens the broader server environment rather than just the Joomla installation. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Phoca Commander is a file manager extension for the Joomla CMS platform, as identified by CPE cpe:2.3:a:phoca.cz:phoca_commander_extension_for_joomla:*:*:*:*:*:*:*:*. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the root cause: the extension's backend handlers for delete, copy, and move operations fail to canonicalize or validate input paths, allowing dot-dot-slash sequences (e.g., '../../../') to traverse outside the intended web directory. The CVSS 4.0 subsequent-system metrics (SC:H/SI:H/SA:H with VC:N/VI:N/VA:N) indicate the extension's own data is not the primary target; rather, the host filesystem accessible to the web server process is exposed. This is a classic server-side path traversal pattern where the application trusts attacker-controlled path components without enforcing a chroot-equivalent boundary check.
RemediationAI
Upgrade Phoca Commander to a version beyond 6.1.3 by consulting the vendor's official release page at https://www.phoca.cz/phocacommander. The exact patched release version is not independently confirmed from available intelligence - verify the specific fixed release number in the vendor changelog before deploying to production. As an immediate compensating control, disable the Phoca Commander extension entirely if file management functionality is not actively required; this eliminates the attack surface with no functional trade-off for sites not using the feature. If the extension must remain active, restrict Joomla administrator access to the minimum necessary accounts and enforce multi-factor authentication on all admin logins to raise the credential-compromise bar. At the OS level, configure the web server process to run under a restricted user with minimal filesystem permissions, and apply read-only mounts or chroot jails where feasible to limit how far a path traversal can reach even if exploitation occurs.
Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files th
Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitra
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high
Reflected cross-site scripting (XSS) in the Phoca Commander extension for Joomla (versions 5.0.0 through 6.1.1) allows r
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today