Which versions of Phoca Commander are affected by EUVD-2026-54412?

Phoca Commander (versions 1.0.0-6.1.3), a file manager extension for Joomla, contains a path traversal vulnerability allowing authenticated administrators to read arbitrary server files including…

How to fix or mitigate EUVD-2026-54412?

Within 24 hours, audit all Joomla installations for Phoca Commander presence and disable the extension immediately to eliminate the attack surface. Over the next 7 days, review Joomla administrator access logs for evidence of file read activity outside expected directories and rotate any credentials stored in configuration files that may have been exposed. Within 30 days, monitor phoca.cz for security advisories on available patches or identify and deploy an alternative file management solution if no patch timeline is published.

Phoca Commander EUVD-2026-54412

Q: What is the CVSS score of EUVD-2026-54412?

EUVD-2026-54412 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-66491 HIGH

Path Traversal (CWE-22)

2026-08-07 Joomla

GHSA-xj92-38c4-rf5r

Path Traversal Phoca Commander Extension For Joomla Phoca Cz

8.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable but requires admin credentials (PR:H); path traversal escapes component scope (S:C) enabling high confidentiality impact; no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 09:21 vuln.today

CVE Published

Aug 07, 2026 - 08:06 cve.org

HIGH 8.2

DescriptionCVE.org

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability.

AnalysisAI

Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files through a path traversal flaw in its getSource function, allowing attackers with Joomla administrator credentials to read files outside the extension's intended directory scope - including sensitive configuration files, credentials, and system files. The CVSS 4.0 score of 8.2 reflects a high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), meaning the disclosure can extend beyond the Joomla application boundary to the underlying server filesystem. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unconfirmed at time of analysis.

Technical ContextAI

Phoca Commander (CPE: cpe:2.3:a:phoca.cz:phoca_commander_extension_for_joomla:*:*:*:*:*:*:*:*) is a web-based file manager plugin for the Joomla CMS, providing administrators with a browser-accessible interface for managing server-side files. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the getSource function accepts user-supplied path parameters without adequate sanitization or canonicalization, allowing traversal sequences such as ../../ to escape the intended file root. Because Phoca Commander operates in the context of the Joomla web server process, the readable file space encompasses any file accessible to that process user - commonly including database credentials in Joomla's configuration.php, private keys, application secrets, and server-level system files.

RemediationAI

Administrators should immediately check the vendor's product page at https://www.phoca.cz/phocacommander for a patched release beyond version 6.1.3 and upgrade if available - no specific fixed version number was confirmed in the available intelligence, so direct verification with phoca.cz is required before assuming a safe version exists. As a compensating control pending patch confirmation, uninstalling or disabling the Phoca Commander extension eliminates the attack surface entirely if file management functionality is not operationally required; note this will remove web-based file management capability from the Joomla backend. Additionally, enforce strict Joomla role hygiene by limiting administrator accounts to the minimum necessary personnel, enabling multi-factor authentication for all admin accounts, and auditing for credential reuse - since PR:H exploitation is gated entirely on admin credential access. Configuring the web server process to run under a user with the minimum necessary filesystem permissions will limit the scope of files exposed even if the flaw is triggered.