Joomla CMS EUVD-2026-89088

Requires an authenticated backend user with sufficient privileges (CVSS PR:H) to invoke the cache purge action - realistically an administrator or Super User account. The specific trigger is a maliciously crafted cache group name containing path-traversal sequences that the file-storage caching layer fails to sanitize; the site must use the file-based cache storage handler for the purge to operate on the filesystem. No user interaction from a victim is needed (UI:N). Affected versions are Joomla 4.0.0-5.4.8 and 6.0.0-6.1.3. The high-privilege requirement is the primary limiting factor, confining the threat to insider/compromised-admin scenarios rather than opportunistic remote attackers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H) scores 7.0, but the real-world risk is materially constrained by PR:H - exploitation requires high privileges, i.e. an authenticated backend user with cache-management access (typically administrator/Super User). This is not a pre-auth network flaw. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is 'no public exploit identified at time of analysis'. No SSVC decision data is supplied. The impact profile is integrity + availability only (VC:N - no data disclosure), consistent with arbitrary directory deletion. The advisory is a Joomla self-report (routine coordinated disclosure), not a signal of observed attacks. Net: a genuine but not urgent priority - a high-privilege, authenticated destructive flaw in a ubiquitous CMS. The 7.0 is somewhat generous given PR:H; my independent read lands lower (~6.5 for 4.0). No conflicting signals in the data, though note the vector's PR:H means the practical attacker population is limited to already-trusted admin accounts.

An authenticated Joomla backend user with access to the cache purge feature submits a crafted cache-group name containing path-traversal sequences (e.g. '../../'), which the file-storage caching layer fails to validate. When the purge action runs, it deletes directories outside the intended cache path, letting the attacker destroy arbitrary directories on the host and cause data loss or site outage. No public exploit code is identified at time of analysis.