EUVD-2026-63939
GHSA-j32c-fpr2-v6gm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated directory listing yields low confidentiality impact; no integrity or availability impact from listing alone.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.
AnalysisAI
Unauthenticated arbitrary directory listing in the Gallery element of the YOOtheme Zoo extension for Joomla exposes server-side directory structures to any remote, unauthenticated attacker on sites running Zoo versions prior to 4.1.66. The path traversal vulnerability (CWE-22) allows crafted requests to enumerate directories outside the intended scope of the Gallery element, potentially revealing sensitive filesystem layout including configuration paths, user data directories, or other installed components. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The YOOtheme Zoo extension must be installed and active on the Joomla instance, and specifically a view or page using the Gallery element must be accessible to unauthenticated users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.9 overstates risk relative to the actual impact class: arbitrary directory listing is an information disclosure primitive, not code execution or data exfiltration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a Joomla site running a vulnerable version of the Zoo extension with an active Gallery element. The attacker crafts an HTTP GET request targeting the Gallery element's directory listing endpoint, injecting path traversal sequences to enumerate directories outside the intended media folder - for example, resolving to the Joomla configuration directory or the server's /etc path. … |
| Remediation | Upgrade the YOOtheme Zoo extension to version 4.1.66 or later, which is the vendor-confirmed fix version per the CVE description. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zoo Extension For Joomla
View allUnauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64)
SQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to i
Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attac
Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attac
Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today