Which versions of Joomla! CMS are affected by EUVD-2026-31888?

Joomla! CMS versions 3.2.1-5.4.5 and 6.0.0-6.1.0 contain a local file inclusion vulnerability that allows high-privilege administrators to read arbitrary server files, including database credentials…

How to fix or mitigate EUVD-2026-31888?

Within 24 hours: Inventory all Joomla instances; identify affected versions (3.2.1-5.4.5, 6.0.0-6.1.0); audit all high-privilege accounts. Within 7 days: Restrict administrative access to essential personnel only; implement audit logging for layout parameter changes and file access events. Within 30 days: Develop upgrade roadmap to unaffected versions; isolate affected instances or migrate to alternative CMS platforms.

Joomla! CMS EUVD-2026-31888

Q: What is the CVSS score of EUVD-2026-31888?

EUVD-2026-31888 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-40383 HIGH

Path Traversal (CWE-22)

2026-05-26 Joomla

GHSA-v8h9-9g8j-w7h4

Path Traversal Joomla Cms

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:58 vuln.today

CVSS changed

May 26, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

May 26, 2026 - 16:45 nvd

UNKNOWN (no severity yet)

CVE Published

May 26, 2026 - 16:45 nvd

HIGH 7.5

DescriptionCVE.org

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

AnalysisAI

Local file inclusion in Joomla! CMS versions 3.2.1 through 5.4.5 and 6.0.0 through 6.1.0 allows authenticated high-privilege attackers to read arbitrary server files via improper validation of the layout parameter in htmlview. The flaw is reported by the Joomla project itself (EUVD-2026-31888) and no public exploit identified at time of analysis, with EPSS scoring 0.00% and CISA SSVC marking exploitation status as none despite total technical impact.

Technical ContextAI

The vulnerability is a CWE-22 path traversal (improper limitation of a pathname to a restricted directory) affecting Joomla!'s htmlview layout parameter handling. Joomla! is a widely deployed PHP-based content management system, and its MVC view layer uses 'layout' parameters to select template files for rendering. When user-supplied input to this parameter is not properly normalized or constrained to an allowlist of legitimate layouts, an attacker can supply traversal sequences (such as ../) to escape the intended template directory and cause the application to include arbitrary files from the underlying filesystem, exposing sensitive configuration, credentials, or other server-side content. The affected CPE is cpe:2.3:a:joomla!_project:joomla!_cms covering both the legacy 3.x-5.x branch and the new 6.x branch.

RemediationAI

Patch available per vendor advisory: upgrade Joomla! CMS to a release beyond the affected ranges (above 5.4.5 in the 3.x-5.x line, and above 6.1.0 in the 6.x line) as published in the Joomla! Security Centre bulletin at https://developer.joomla.org/security-centre/1041-20260509-core-lfi-in-htmlview-layout-parameter.html; the input data does not name an exact fixed version, so consult the linked advisory for the precise build number. Until patching is possible, restrict administrative and back-end access to trusted IP ranges via web server or WAF rules to neutralize the PR:H prerequisite, audit and rotate credentials for any account with privileged Joomla! access, and add WAF signatures to block traversal sequences (../, %2e%2e%2f, encoded variants) in the 'layout' query parameter on htmlview-handling routes, accepting that overly broad path-traversal rules may cause false positives on legitimate template names. Review web server and application logs for prior abuse of the layout parameter by administrative sessions.