CVE-2026-66491: Phoca Commander Path Traversal Flaw

CVE-2026-66491 Overview

CVE-2026-66491 is a path traversal vulnerability [CWE-22] affecting the Phoca Commander extension for Joomla, versions 1.0.0 through 6.1.3. The flaw resides in the getSource function, which fails to properly restrict file path input. An authenticated attacker with high privileges can read arbitrary files from the underlying server. Successful exploitation exposes sensitive configuration files, credentials, and application source code stored outside the intended directory scope.

Critical Impact
Authenticated attackers can read arbitrary files on the Joomla host, including configuration files containing database credentials and API secrets.

Affected Products

Phoca Commander for Joomla, versions 1.0.0 through 6.1.3
Joomla installations running Phoca Commander extension
Joomla sites where the extension is enabled for content management

Discovery Timeline

2026-08-07 - CVE-2026-66491 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-66491

Vulnerability Analysis

The vulnerability affects the getSource function within Phoca Commander, a file management extension for Joomla. The function accepts a file path parameter used to load and return file contents to the requesting user. Because the function does not validate or canonicalize the supplied path, attackers can inject directory traversal sequences such as ../ to escape the intended working directory.

An authenticated user with the required privilege level can request paths outside the extension's file scope. The server reads the target file and returns its contents in the HTTP response. This exposes any file readable by the web server process, including Joomla's configuration.php, which stores database credentials and secret tokens.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The getSource function trusts user-supplied path input without normalizing it against an allowed base directory. Neither input filtering nor a post-resolution boundary check is performed before the file read operation executes.

Attack Vector

The attack is executed over the network against the Joomla administrative interface. The attacker must hold high privileges within the Joomla application to reach the vulnerable endpoint. Once authenticated, the attacker submits a crafted request containing traversal sequences pointing to a target file. The server returns the file contents in the response body, completing the disclosure.

See the Phoca Commander Resource for extension documentation.

Detection Methods for CVE-2026-66491

Indicators of Compromise

Web server access logs containing requests to Phoca Commander endpoints with ../ or URL-encoded %2e%2e%2f sequences in path parameters.
Successful HTTP 200 responses to Phoca Commander file source requests referencing files outside the extension's directory, such as configuration.php or /etc/passwd.
Unexpected reads of sensitive Joomla configuration files by the web server user account.

Detection Strategies

Inspect Joomla administrative logs for authenticated sessions invoking Phoca Commander file source actions with unusual path arguments.
Deploy web application firewall rules that flag directory traversal patterns targeting Phoca Commander component URLs.
Correlate high-privilege administrator activity with file read operations against paths outside the media or upload directories.

Monitoring Recommendations

Enable verbose logging on the Joomla administrator interface and forward logs to a centralized SIEM for query and retention.
Alert on any read access to configuration.php originating from the web server process during interactive administrative sessions.
Track privileged account activity and review new administrator logins from unfamiliar source addresses.

How to Mitigate CVE-2026-66491

Immediate Actions Required

Upgrade Phoca Commander to a version above 6.1.3 once a patched release is published by the vendor.
Restrict Joomla administrator accounts and enforce multi-factor authentication for all privileged users.
Audit existing administrator accounts and revoke access for accounts that no longer require it.

Patch Information

Refer to the Phoca Commander Resource for vendor release notes and updated download packages. Apply the fixed version through the Joomla Extension Manager once available.

Workarounds

Disable the Phoca Commander extension in the Joomla Extension Manager until a patched version is installed.
Restrict access to the Joomla administrator directory using web server access control rules or IP allowlisting.
Apply web application firewall signatures that block directory traversal payloads targeting Joomla component endpoints.

bash

# Example Apache rule to block traversal patterns on Phoca Commander endpoints
<LocationMatch "/administrator/components/com_phocacommander">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|%2e%2e/) [NC]
    RewriteRule .* - [F,L]
</LocationMatch>