CVE-2026-66493
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.
Risk Assessment
The risk includes unauthorized access to sensitive files on the server, which can lead to data disclosure or further system compromise.
Recommendation
It is recommended to update Phoca Commander to the latest version that includes security fixes and implement path validation for file operations.
Other vulnerabilities in Phoca Commander
See all- CVE-2026-66492Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.
- CVE-2026-66491High
Arbitrary file read vulnerability in Phoca Commander 1.0.0-6.1.3 for Joomla. Improper limitation of paths in the getSource function leads to arbitrary file read.
- CVE-2026-65765Medium
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.
- CVE-2026-65764Medium
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability.
Original NVD description (English source)
Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.