Which versions of SEBLOD are affected by CVE-2026-66914?

SEBLOD, a widely-deployed Joomla extension, contains a critical vulnerability allowing unauthenticated attackers to steal configuration data and credentials (CVE-2026-66914).

How to fix or mitigate CVE-2026-66914?

Within 24 hours, audit all Joomla deployments for SEBLOD installation and identify which run vulnerable versions (before 3.30.0, 4.7.0, or 6.0.1); catalog sensitive files accessible outside the webroot. Within 7 days, disable SEBLOD if operationally feasible, apply web server rules to block directory traversal patterns (../, URL-encoded variants), restrict file permissions on configuration and credential stores, and enable detailed access logging. Within 30 days, plan Joomla upgrades to 3.30.0+, 4.7.0+, or 6.0.1+ to deploy vendor patches once available, and evaluate replacement solutions if SEBLOD is not essential.

SEBLOD CVE-2026-66914

Q: What is the CVSS score of CVE-2026-66914?

CVE-2026-66914 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54480 CRITICAL

Path Traversal (CWE-22)

2026-08-07 Joomla

GHSA-jqjq-6rcj-5vpj

Path Traversal Seblod Extension For Joomla

9.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network path traversal reading files beyond the app directory gives S:C and C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:15 vuln.today

CVE Published

Aug 07, 2026 - 13:15 cve.org

CRITICAL 9.2

DescriptionCVE.org

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot.

AnalysisAI

Arbitrary file disclosure in the SEBLOD content construction kit (CCK) extension for Joomla lets unauthenticated remote attackers read files both inside and outside the webroot via directory traversal, affecting versions before 3.30.0, before 4.7.0, and before 6.0.1. Reported by the Joomla project (EUVD-2026-54480) and rated CVSS 4.0 9.2, the flaw requires no authentication or user interaction and can expose configuration files, credentials, and secrets. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

SEBLOD is a popular application/content builder (CCK) extension for the Joomla CMS, typically running as a PHP component that serves user-supplied requests. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal'): a request parameter that names a file is used to build a filesystem path without adequately canonicalizing or constraining it, so traversal sequences (e.g. '../') let the request escape the intended download directory. Because the handler resolves paths relative to the server filesystem rather than a sandboxed directory, an attacker can reach both application files under the webroot (such as Joomla's configuration.php) and sensitive OS files outside it. The CPE cpe:2.3:a:seblod.com:seblod_extension_for_joomla identifies the single affected component.

RemediationAI

Upgrade SEBLOD to a fixed release matching your branch: version 3.30.0 or later for the 3.x line, 4.7.0 or later for the 4.x line, or 6.0.1 or later for the 6.x line (Vendor-released patch: 3.30.0 / 4.7.0 / 6.0.1). Obtain the update from the vendor at https://www.seblod.com/ and apply it through Joomla's extension manager. If you cannot patch immediately, restrict reachability of the vulnerable SEBLOD download/file-handling endpoint at the web server or WAF layer - block requests containing traversal sequences (e.g. '../', encoded '%2e%2e', or absolute paths) and limit access to the component to trusted IPs; note that WAF filtering can be bypassed with alternate encodings and IP restrictions may break legitimate front-end functionality that relies on SEBLOD-served files. As a defense-in-depth measure, rotate any secrets stored in configuration.php (database credentials, Joomla secret) in case files were already exfiltrated, and ensure the web server user has least-privilege filesystem access.