CVE-2026-117542
Received Received - Intake

Authenticated Path Traversal in jDownloads Joomla Extension

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Joomla! Project

Description
Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-117542
EUVD
EUVD-2026-124612

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
joomla jdownloads to 4.1.8 (exc)
jdownloads jdownloads to 4.1.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-35 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated path traversal vulnerability in the jDownloads Joomla extension version before 4.1.8. An attacker with valid credentials can manipulate the update_file parameter in a form to bypass file selection restrictions. This allows moving files outside the intended directory or reassigning them to downloads, potentially exposing sensitive file contents or deleting original files.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive files on the server, leading to data leaks or file corruption. Attackers might read confidential information, delete critical files, or manipulate downloadable content. The impact depends on the server's file permissions and the files stored.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and compliance violations if exploited.

Mitigation Strategies

Update the jDownloads extension to version 4.1.8 or later to address the authenticated path traversal vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...