CVE-2026-73327
|
| |
|
|
Affected software |
JOOMLA |
|
|
|
Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be written outside the intended destination root and enabling persistent remote code execution via planted PHP files. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-73327 |
