CVE-2026-65765
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
Risk Assessment
The organization risks that an attacker can read or write arbitrary files on the server, potentially leading to data leakage, file modification, or compromise of the Joomla site.
Recommendation
Update Phoca Commander to a version above 6.1.1 that fixes the path limitation, or apply the available patch.
Other vulnerabilities in Phoca Commander
See all- CVE-2026-66493Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.
- CVE-2026-66492Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.
- CVE-2026-66491High
Arbitrary file read vulnerability in Phoca Commander 1.0.0-6.1.3 for Joomla. Improper limitation of paths in the getSource function leads to arbitrary file read.
- CVE-2026-65764Medium
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Original NVD description (English source)
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.