YOOtheme Pro CVE-2026-75115

Exploitation requires an authenticated session with high-privilege access (PR:H per the CVSS 4.0 vector) to the Joomla administrative backend. Specifically, the attacker must have access to the YOOtheme Pro Filesystem source feature within the Joomla backend - this feature must be present and accessible under the attacker's role. Affected versions are explicitly 2.3.0 through 5.0.40; installations outside this range are not confirmed affected. The Joomla instance must be running YOOtheme Pro as an active extension. Exploitation is NOT possible by unauthenticated users or by low-privilege front-end Joomla subscribers. The key limiting factor is the requirement for a valid, high-privilege backend account, making this primarily an insider-threat or post-credential-compromise vector rather than an opportunistic internet-wide attack.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N) scores 7.0, reflecting a meaningful but access-controlled risk. The PR:H metric is the primary mitigating factor: exploitation is limited to users already holding high-privilege Joomla backend accounts. This restricts the realistic attacker population to insiders, compromised admins, or attackers who have separately obtained administrative credentials. No CISA KEV listing exists, and no confirmed public proof-of-concept exploit has been identified in the available intelligence. EPSS data is absent from the provided sources, preventing probabilistic exploitation likelihood assessment. The VC:H rating is well-justified - arbitrary file read can expose database credentials, API keys, or other secrets stored on the filesystem. The SC:L metric acknowledges that secrets read from the vulnerable system can cascade to compromise adjacent systems. On balance, this is a medium-real-world-priority issue for most organizations unless Joomla admin accounts are shared, weakly authenticated, or accessible to untrusted parties.

An attacker who has obtained or holds a high-privilege Joomla backend account (administrator or equivalent) navigates to the YOOtheme Pro Filesystem source configuration and submits a crafted glob pattern such as /etc/* or /var/www/html/configuration.php as the path filter value. The server-side file enumeration resolves the pattern without sanitization, returning the contents of arbitrary files - such as Joomla's configuration.php containing database credentials - directly to the attacker's browser session. No public proof-of-concept exploit has been identified, but the technique is well-understood given the CWE-22 root cause.