Skip to main content

Joomla EUVDEUVD-2025-16991

| CVE-2025-27445 MEDIUM
Path Traversal: '.../...//' (CWE-35)
2025-06-05 security@joomla.org
Path Traversal Joomla
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
EUVD ID Assigned
Mar 14, 2026 - 17:53 euvd
EUVD-2025-16991
Analysis Generated
Mar 14, 2026 - 17:53 vuln.today
CVE Published
Jun 05, 2025 - 14:15 nvd
MEDIUM 5.4

DescriptionCVE.org

A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of user-supplied input in file path parameters, allowing attackers to exploit directory traversal sequences (e.g., ../) to access sensitive files

Analysis

A path traversal vulnerability in RSFirewall component 2.9.7 - 3.1.5 for Joomla was discovered. This vulnerability allows authenticated users to read arbitrary files outside the Joomla root directory. The flaw is caused by insufficient sanitization of user-supplied input in file path parameters, allowing attackers to exploit directory traversal sequences (e.g., ../) to access sensitive files

Technical ContextAI

Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.

RemediationAI

Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.

More in Joomla

View all
CVE-2017-8917 CRITICAL POC
9.8 May 17

SQL injection vulnerability in Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2016-10045 CRITICAL POC
9.8 Dec 30

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
CVE-2015-8562 HIGH POC
7.5 Dec 16

Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public explo
CVE-2015-7297 HIGH POC
7.5 Oct 29

SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low

CVE-2016-8869 CRITICAL POC
9.8 Nov 04

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!. Rated
CVE-2016-8870 HIGH POC
8.1 Nov 04

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!. Rated
CVE-2015-7857 HIGH POC
7.5 Oct 29

SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.p
CVE-2015-7858 HIGH POC
7.5 Oct 29

SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low

CVE-2013-5576 MEDIUM POC
6.8 Oct 09

administrator/components/com_media/helpers/media.php in the media manager in Joomla!. Rated medium severity (CVSS 6.8),

CVE-2014-7228 HIGH POC
7.5 Nov 03

Akeeba Restore (restore.php), as used in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2014-7981 HIGH POC
7.5 Oct 08

SQL injection vulnerability in Joomla!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low

CVE-2017-14596 CRITICAL POC
9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

Same weakness CWE-35 – Path Traversal: '.../...//'

View all
CVE-2024-2863 CRITICAL POC
9.8
CVE-2018-3744 CRITICAL POC
9.8
CVE-2024-36991 HIGH POC
7.5
CVE-2026-6074 CRITICAL
9.3
CVE-2024-45190 MEDIUM POC
6.5
CVE-2025-30515 CRITICAL
9.8
CVE-2026-52703 CRITICAL
9.6
CVE-2025-59793 CRITICAL
9.4

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

EUVD-2025-16991 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy