CVE-2026-66492
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.
Risk Assessment
The risk includes the possibility of writing malicious files to the server, which can lead to code execution or application takeover.
Recommendation
It is recommended to update Phoca Commander to the latest version that includes security fixes and implement path validation for file upload operations.
Other vulnerabilities in Phoca Commander
See all- CVE-2026-66493Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.
- CVE-2026-66491High
Arbitrary file read vulnerability in Phoca Commander 1.0.0-6.1.3 for Joomla. Improper limitation of paths in the getSource function leads to arbitrary file read.
- CVE-2026-65765Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
- CVE-2026-65764Medium
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Original NVD description (English source)
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.