CVE-2026-73327
Received Received - Intake

Path Traversal in Joomla com_joomlaupdate

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description
Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be written outside the intended destination root and enabling persistent remote code execution via planted PHP files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73327
EUVD
EUVD-2026-57390

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomla joomla to 6.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in Joomla 6.1.1's com_joomlaupdate extension. It allows a Super User to extract a malicious ZIP archive containing directory traversal sequences or absolute paths in filenames. The extract.php file processes these filenames without validation, enabling attackers to write files outside the intended directory. This can lead to persistent remote code execution by planting PHP files in accessible locations.

Detection Guidance

Check Joomla installations for Joomla 6.1.1 or earlier. Review extract.php in com_joomlaupdate for unvalidated ZIP entry handling. Monitor for unexpected file writes outside intended directories during ZIP extraction.

Impact Analysis

If exploited, this vulnerability allows attackers to write files outside the intended extraction directory. This could lead to remote code execution, privilege escalation, or full host compromise. Attackers might plant PHP files in critical system locations or other websites hosted on the same server. The attack requires Super User access but could escalate from site admin to host-level control.

Compliance Impact

This vulnerability could lead to unauthorized file access, data breaches, or code execution, violating GDPR's integrity and confidentiality requirements. For HIPAA, it risks exposing protected health information. Compliance failures may result in fines, legal action, or mandatory breach notifications depending on affected data.

Mitigation Strategies

Apply the patch from commit 9678a17 to Joomla 6.1.1 or upgrade to a patched version. Restrict Super User access to trusted personnel only. Avoid extracting ZIP archives from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73327. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart