Phoca Commander Extension For Joomla
Monthly
Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files through a path traversal flaw in its getSource function, allowing attackers with Joomla administrator credentials to read files outside the extension's intended directory scope - including sensitive configuration files, credentials, and system files. The CVSS 4.0 score of 8.2 reflects a high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), meaning the disclosure can extend beyond the Joomla application boundary to the underlying server filesystem. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unconfirmed at time of analysis.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Path traversal in Phoca Commander (Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 enables authenticated Joomla administrators to escape intended directory boundaries during delete, copy, and move file operations, reaching arbitrary locations on the host filesystem. The CVSS 4.0 vector confirms high subsequent-system impact (SC:H/SI:H/SA:H) with no direct impact on the extension itself, meaning successful exploitation threatens the broader server environment rather than just the Joomla installation. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.
We need to produce a JSON object with all specified fields. Let's analyze the provided data. CVE: CVE-2026-65764 Description: "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability." CVSS Score: 5.1, CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N (CVSS 4.0). We have to assess our own CVSS 3.1 and 4.0 vectors. We'll derive from description and exploitation conditions. The description says reflected XSS, improper validation of user inputs. Typically Reflected XSS requires user interaction (UI:A in CVSS 4.0), and the CVSS provided shows UI:A (user interaction required). AV:N, PR:N (no privileges required), AC:L, AT:N for 4.0. Impact to vulnerable component: VC:L, VI:L, VA:L (low integrity, low availability? Actually XSS usually affects confidentiality and integrity, not availability. But here VC:L, VI:L, VA:L. Might be impact on user session, not system. We'll produce our own assessment. For CVSS 3.1, for reflected XSS we'd set AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N maybe, or scope unchanged. Often reflected XSS scope is unchanged, but if the vulnerable component is the web application itself, and impact is to the user (like stealing cookies), scope is unchanged. Many CVSS 3.1 vectors for reflective XSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N or AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. I'll assess based on typical XSS: require user to click a link, low integrity (inject script), low confidentiality (steal data). Availability N/L? Usually none, but here VA:L in CVSS4.0, so maybe there's some availability impact. Since it's reflected, maybe it can deface the page, but not availability of the system. I'll set C:L, I:L, A:N. Scope: unchanged because the vulnerability is in the web application, and the impact is on the same component (the user's browser interacting with the app, but scope is typically unchanged for reflected XSS where the malic
Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files through a path traversal flaw in its getSource function, allowing attackers with Joomla administrator credentials to read files outside the extension's intended directory scope - including sensitive configuration files, credentials, and system files. The CVSS 4.0 score of 8.2 reflects a high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), meaning the disclosure can extend beyond the Joomla application boundary to the underlying server filesystem. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unconfirmed at time of analysis.
Path traversal in Phoca Commander (a Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 allows high-privileged authenticated users to write uploaded files to arbitrary filesystem locations outside the intended upload directory, achieving high integrity impact on the underlying server. The CVSS 4.0 vector (PR:H/SI:H) confirms that while exploitation requires administrator-level Joomla access, a successful attack can affect the server filesystem beyond the Joomla webroot - enabling PHP shell planting or overwriting sensitive configuration files. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is known at time of analysis.
Path traversal in Phoca Commander (Joomla file manager extension by phoca.cz) versions 1.0.0 through 6.1.3 enables authenticated Joomla administrators to escape intended directory boundaries during delete, copy, and move file operations, reaching arbitrary locations on the host filesystem. The CVSS 4.0 vector confirms high subsequent-system impact (SC:H/SI:H/SA:H) with no direct impact on the extension itself, meaning successful exploitation threatens the broader server environment rather than just the Joomla installation. No public exploit code or active exploitation has been identified at time of analysis.
Path traversal vulnerability in the Phoca Commander Joomla extension allows authenticated administrators to read arbitrary files on the server via crafted save and download requests. Affected versions are 1.0.0 through 6.1.1. No active exploitation has been reported, and no public exploit code is known.
We need to produce a JSON object with all specified fields. Let's analyze the provided data. CVE: CVE-2026-65764 Description: "Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability." CVSS Score: 5.1, CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N (CVSS 4.0). We have to assess our own CVSS 3.1 and 4.0 vectors. We'll derive from description and exploitation conditions. The description says reflected XSS, improper validation of user inputs. Typically Reflected XSS requires user interaction (UI:A in CVSS 4.0), and the CVSS provided shows UI:A (user interaction required). AV:N, PR:N (no privileges required), AC:L, AT:N for 4.0. Impact to vulnerable component: VC:L, VI:L, VA:L (low integrity, low availability? Actually XSS usually affects confidentiality and integrity, not availability. But here VC:L, VI:L, VA:L. Might be impact on user session, not system. We'll produce our own assessment. For CVSS 3.1, for reflected XSS we'd set AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N maybe, or scope unchanged. Often reflected XSS scope is unchanged, but if the vulnerable component is the web application itself, and impact is to the user (like stealing cookies), scope is unchanged. Many CVSS 3.1 vectors for reflective XSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N or AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. I'll assess based on typical XSS: require user to click a link, low integrity (inject script), low confidentiality (steal data). Availability N/L? Usually none, but here VA:L in CVSS4.0, so maybe there's some availability impact. Since it's reflected, maybe it can deface the page, but not availability of the system. I'll set C:L, I:L, A:N. Scope: unchanged because the vulnerability is in the web application, and the impact is on the same component (the user's browser interacting with the app, but scope is typically unchanged for reflected XSS where the malic