EUVD-2026-63938
GHSA-42xr-8p7f-gqh6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges required (PR:H) to reach the Filesystem source; only confidentiality is impacted as description confirms file read only.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.
AnalysisAI
Arbitrary file read in YOOtheme Pro (Joomla extension) versions 2.3.0 through 5.0.40 allows privileged authenticated users to access files outside the intended directory by exploiting glob-based pattern injection in the Filesystem source's path filter. The vulnerability requires high-privilege credentials on the Joomla backend, limiting the attack surface to trusted but potentially malicious insiders or compromised administrator accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with high-privilege access (PR:H per the CVSS 4.0 vector) to the Joomla administrative backend. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N) scores 7.0, reflecting a meaningful but access-controlled risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or holds a high-privilege Joomla backend account (administrator or equivalent) navigates to the YOOtheme Pro Filesystem source configuration and submits a crafted glob pattern such as /etc/* or /var/www/html/configuration.php as the path filter value. The server-side file enumeration resolves the pattern without sanitization, returning the contents of arbitrary files - such as Joomla's configuration.php containing database credentials - directly to the attacker's browser session. … |
| Remediation | Upgrade YOOtheme Pro to a version above 5.0.40; the exact patched release version is not independently confirmed from the available references - consult the vendor changelog at https://www.yootheme.com/ for the precise fixed build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Joomla instances running YOOtheme Pro and confirm which are on affected versions 2.3.0-5.0.40; restrict Joomla administrator role assignments to only essential personnel and disable unused administrator accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in YOOtheme Pro for Joomla (versions 1.0.0-5.0.40) allows any authenticated contributor-level user to embe
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, pri
Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today