Event Gallery EUVD-2026-87931

Requires an authenticated Joomla session with HIGH privileges (backend/administrator level) able to reach the Event Gallery cache.process clear-cache task - this is the primary limiting factor (PR:H). The Event Gallery extension (svenbluege.de) at a version below 6.5.0 must be installed. Exploitation is performed by placing a directory-traversal payload in the images parameter of the cache.process task; deletion is bounded to directories the web server user has write permission to. No user interaction and no special non-default configuration beyond having the vulnerable extension installed are needed.

This is a genuine but modestly-scoped issue. The vendor/Joomla JSST CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H, score 7.0) shows a network-reachable, low-complexity flaw with NO user interaction, but critically requires HIGH privileges (PR:H) - meaning an already-authenticated backend/administrator-level Joomla account is needed to reach the cache.process task. Impact is integrity and availability only (VI:H/VA:H), no confidentiality (VC:N), consistent with a destructive file-deletion primitive rather than data theft or code execution. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent exploitation. SSVC-style read: exploitation status = none observed, automatable = unlikely (requires authenticated context and per-target path knowledge), technical impact = partial-to-total on the file store. The PR:H requirement is the dominant risk-limiter - an attacker who already holds a high-privilege Joomla account can typically cause damage through legitimate admin functions anyway, so the marginal added risk is bounded. Net: a real, patch-worthy defect but a low real-world priority absent exploitation evidence. No conflicting signals were found in the data; the description ('authenticated', 'directories the web server is authorized to write to') aligns well with the PR:H/VI:H/VA:H vector.

An attacker who has obtained a high-privilege Joomla backend account (e.g., via credential compromise or a rogue administrator) invokes the Event Gallery cache.process clear-cache task and supplies a path-traversal payload in the images parameter to point outside the intended cache directory. The extension then recursively deletes the referenced directory tree, destroying arbitrary content anywhere the web server user can write (site files, uploads, other extensions' data). No public exploit code is identified at time of analysis.