Joomla CMS CVE-2026-73327

Exploitation requires Joomla 6.1.1 with the com_joomlaupdate component active (this is a default core component). The critical limiting condition is that a Super User - the highest privilege level in Joomla - must be actively induced into initiating extraction of an attacker-supplied ZIP archive through the administrator update interface; the attacker cannot trigger this autonomously. The PHP process running the extraction must have write permissions to directories outside the intended extraction root (common in shared hosting or misconfigured environments). Exploitation is bounded by: (1) the mandatory Super User cooperation requirement (UI:A per CVSS 4.0), preventing any automated or opportunistic attack; (2) the high privilege target (PR:H), meaning only Super User accounts are the relevant social engineering surface; and (3) the requirement that the attacker deliver a specifically crafted archive and convince the Super User to extract it, reflecting the AC:H complexity rating. Default configurations with a single well-guarded Super User account significantly reduce realistic exposure beyond the raw CVSS score.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:H/AT:N/PR:H/UI:A reflects the genuine severity of the impact (full C/I/A compromise of both vulnerable and subsequent systems) while accurately encoding the significant exploitation barriers: high attack complexity (AC:H) for the social engineering component, high privilege requirement (PR:H for Super User), and mandatory active user interaction (UI:A). In practice, this is a meaningful constraint - the attacker cannot directly trigger extraction and must specifically target one of the most privileged Joomla accounts. Despite the high CVSS score, opportunistic mass exploitation is unlikely; this is more suited to targeted attacks against specific Joomla installations. No CISA KEV listing exists, and no public POC has been identified at time of analysis. EPSS data was not provided. The payload impact is severe - successful exploitation yields persistent server-level RCE via planted PHP webshells - so targeted risk remains high even if bulk exploitation probability is low. The CVSS 4.0 subsequent-system metrics (SC:H/SI:H/SA:H) correctly capture that a planted PHP shell can affect the broader server environment beyond Joomla itself.

An attacker crafts a ZIP archive with entries named using traversal sequences such as ../../webroot/malicious.php, then socially engineers a Joomla Super User - via phishing, a fake update notification, or a compromised plugin - into uploading and extracting the archive through the com_joomlaupdate administrator interface. The unpatched extract.php routine writes the PHP file outside the intended extraction directory into a web-accessible path, granting the attacker persistent unauthenticated remote code execution on the server. No public POC has been identified at time of analysis, but the technique is well-understood and the fix provides a clear roadmap for reconstruction.