Joomla! CMS EUVD-2026-31885

Exploitation requires an authenticated session with high-privilege credentials - specifically a Joomla Super User or Administrator role - as confirmed by the CVSS 4.0 PR:H designator. The CVSS AT:P (Attack Requirements: Present) indicator further confirms that additional prerequisites beyond a network connection exist, consistent with the need for prior authentication. The com_media web service (REST API) endpoint must be accessible, which is the default in Joomla 4.x+ deployments. Exploitation is limited to read-only file disclosure (no write or execution capability); integrity and availability are not affected. Environments where the web process user has broad filesystem read permissions (e.g., running as root or a highly permissive OS user) face greater exposure. Joomla installations on 3.x or earlier are not listed as affected.

The CVSS 4.0 base score of 5.9 (Medium) reflects a constrained threat model: the attack vector is network (AV:N) and complexity is low (AC:L), but the attack requires both high privileges (PR:H) and additional attack prerequisites (AT:P), significantly raising the bar for exploitation. The impact is confidentiality-only (VC:H, VI:N, VA:N) with no subsequent system scope, meaning integrity and availability are unaffected. EPSS at 0.02% (4th percentile) indicates very low community-assessed exploitation probability relative to the broader CVE population. SSVC corroborates this: exploitation status is 'none', the attack is not automatable, and technical impact is rated 'partial'. There is no CISA KEV listing and no public exploit code. The realistic risk is limited to insider threat or compromised high-privilege CMS accounts being leveraged for targeted file disclosure - not opportunistic mass exploitation. The primary concern is exposure of sensitive configuration files (e.g., database credentials in configuration.php) if an attacker already holds a Super User or Administrator account.

An attacker who has compromised or legitimately holds a Joomla Super User or Administrator account sends a crafted HTTP GET request to the com_media REST API endpoint with a search parameter containing path traversal sequences (e.g., search=../../configuration.php), causing the server to return the contents of files outside the media directory. This could expose Joomla's configuration.php, which contains plaintext database credentials, enabling lateral movement to the underlying database. No public exploit code exists at time of analysis, but the technique is well-understood and low in technical complexity once authenticated access is obtained.