YOOtheme Zoo EUVD-2026-63939

The YOOtheme Zoo extension must be installed and active on the Joomla instance, and specifically a view or page using the Gallery element must be accessible to unauthenticated users. Sites that install Zoo but do not publish any Gallery element to public-facing pages are not exposed via this attack vector. No authentication is required (PR:N confirmed by CVSS 4.0 vector). No user interaction is needed. Exploitation is limited to directory listing - there is no confirmed file content read or write capability from this flaw alone. Restricting Gallery element views to authenticated users (Joomla access levels) would eliminate the unauthenticated exposure.

The CVSS 4.0 base score of 6.9 overstates risk relative to the actual impact class: arbitrary directory listing is an information disclosure primitive, not code execution or data exfiltration. The absence of KEV listing and any public POC further reduces urgency. EPSS data is not available in the provided intelligence, and no active exploitation evidence is present. The attack complexity is genuinely low and authentication is not required (PR:N, AC:L, AT:N), which means any internet-connected Joomla site using Zoo's Gallery element is passively exposed. The practical risk lies in reconnaissance value - directory listings can reveal environment paths, plugin names, backup file locations, or configuration file names that feed further attacks. The CVSS 4.0 vector assigns VI:L and VC:N, which conflicts with the expected impact profile of directory listing (a confidentiality issue, not an integrity issue); this inconsistency should be treated as unverified until the vendor advisory clarifies it. Overall, priority is moderate: patch promptly but below critical/KEV-tier vulnerabilities.

An unauthenticated attacker identifies a Joomla site running a vulnerable version of the Zoo extension with an active Gallery element. The attacker crafts an HTTP GET request targeting the Gallery element's directory listing endpoint, injecting path traversal sequences to enumerate directories outside the intended media folder - for example, resolving to the Joomla configuration directory or the server's /etc path. The enumerated directory names and structure are returned in the response, giving the attacker reconnaissance data to identify further attack targets. No public POC has been identified at time of analysis.