CVE-2026-97164
Received Received - Intake

Authenticated Path Deletion in Event Gallery Joomla Extension

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: Joomla! Project

Description
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `cache.process` task, you can recursively delete any directories that the web server is authorized to write to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-97164
EUVD
EUVD-2026-87931

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
svenbluege event_gallery to 6.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated vulnerability in the Joomla Event Gallery extension versions before 6.5.0. It allows an attacker with valid credentials to delete arbitrary directories on the server by exploiting the cache processing task. The vulnerability exists due to improper validation of the 'images' parameter in the 'cache.process' task, enabling recursive directory deletion within the web server's write permissions.

Detection Guidance

This vulnerability allows authenticated attackers to delete arbitrary directories via the Event Gallery extension's cache processing. To detect it, check for unusual file or directory deletions in web server writeable paths. Review Joomla logs for suspicious cache.process task executions with the images parameter. Inspect file system permissions on directories accessible by the web server user.

Impact Analysis

If exploited, this vulnerability could allow an attacker to delete critical files or directories on your server, potentially causing data loss, system instability, or denial of service. Since it requires authentication, the risk is limited to users with valid access, but the impact could be severe depending on which directories are targeted.

Compliance Impact

This vulnerability allows authenticated attackers to delete arbitrary directories writable by the web server, which could include sensitive data storage paths. Such unauthorized deletion may violate GDPR's integrity principle (Article 5) and HIPAA's integrity and availability requirements by compromising data integrity or causing data loss.

Mitigation Strategies

Immediately update the Event Gallery extension to version 6.5.0 or higher. If an update is not immediately available, disable the cache.process task or restrict access to authenticated users with minimal privileges. Review and restrict file system permissions for the web server user to limit directory deletion capabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart