CVE-2026-65765: Phoca Commander Path Traversal Flaw

CVE-2026-65765 Overview

CVE-2026-65765 is a path traversal vulnerability [CWE-22] affecting the Phoca Commander extension for Joomla, versions 1.0.0 through 6.1.1. The flaw stems from improper limitation of file paths within the extension's save and download actions. Authenticated attackers with high privileges can access files outside the intended directory scope by supplying crafted path sequences. Successful exploitation exposes sensitive server-side files that fall outside the application's expected working directory.

Critical Impact
Authenticated attackers can traverse the file system to read or write files beyond Phoca Commander's intended directory, resulting in confidentiality impact to the underlying host.

Affected Products

Phoca Commander for Joomla 1.0.0 through 6.1.1
Joomla installations with the Phoca Commander extension enabled
Web servers hosting vulnerable Phoca Commander deployments

Discovery Timeline

2026-07-27 - CVE-2026-65765 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-65765

Vulnerability Analysis

The vulnerability resides in the save and download handlers of Phoca Commander, a file management extension for Joomla. The extension accepts user-supplied path parameters without adequately restricting traversal sequences such as ../. An authenticated user with sufficient privileges can supply crafted parameters that resolve outside the intended base directory. The result is unauthorized access to arbitrary files readable by the web server process.

The attack requires network access to the Joomla administrative interface and valid credentials with elevated permissions. The scope extends beyond the vulnerable component because reachable files may include Joomla configuration data, credentials, and other host resources.

Root Cause

The root cause is missing or insufficient path canonicalization in the save and download routines. Phoca Commander concatenates user-controlled input into file system paths without validating that the resolved path remains within the permitted directory boundary. Standard defenses such as realpath() comparisons or allowlisted directory prefixes are either absent or bypassable in the affected versions.

Attack Vector

An authenticated attacker submits a request to a save or download endpoint that includes a file or directory parameter containing traversal sequences. The application resolves the path relative to its working directory and performs the requested file operation on the resulting location. Because the check happens before canonicalization, the operation succeeds against files outside the extension's intended scope. The vulnerability requires high privileges but no user interaction. See the Phoca Commander product page for extension details.

Detection Methods for CVE-2026-65765

Indicators of Compromise

Web server logs containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in requests to Phoca Commander save or download endpoints
Unexpected file reads or writes performed by the Joomla web server process outside the Phoca Commander data directory
Administrative session activity from atypical source addresses accessing file management endpoints

Detection Strategies

Inspect Joomla access logs for requests to Phoca Commander controllers that include suspicious path parameters
Monitor file access patterns of the web server user for reads of sensitive files such as configuration.php outside typical application flow
Correlate administrative logins with subsequent file download actions targeting non-standard paths

Monitoring Recommendations

Enable verbose logging on the Joomla administrator interface, including request bodies for extension endpoints
Deploy a web application firewall rule that flags path traversal patterns in requests targeting /administrator/ routes
Alert on file integrity changes to Joomla core files and configuration when they originate from the web server process

How to Mitigate CVE-2026-65765

Immediate Actions Required

Restrict access to the Joomla administrator interface using network controls or IP allowlisting until a patched version is deployed
Audit accounts with permissions to invoke Phoca Commander save and download functions and remove unnecessary privileges
Review recent administrator activity for evidence of anomalous file access

Patch Information

Refer to the Phoca Commander product page for the current release and update guidance. Upgrade to a version later than 6.1.1 once the vendor publishes a fix that addresses the path traversal in the save and download actions.

Workarounds

Temporarily disable the Phoca Commander extension in the Joomla Extensions Manager if a patched version is not yet available
Enforce file system permissions that prevent the web server user from reading sensitive files outside the Joomla document root
Apply web application firewall signatures that block path traversal payloads targeting Phoca Commander endpoints

bash

# Example WAF rule concept to block traversal patterns on Phoca Commander endpoints
# Adjust to your WAF engine syntax
SecRule REQUEST_URI "@rx /administrator/.*option=com_phocacommander" \
  "chain,deny,status:403,id:1026065765,msg:'Phoca Commander path traversal attempt'"
SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" "t:none,t:urlDecodeUni"