CVE-2026-66493: Phoca Commander Path Traversal Flaw

CVE-2026-66493 Overview

CVE-2026-66493 is a path traversal vulnerability [CWE-22] in Phoca Commander, a file management extension for Joomla published by phoca.cz. Affected versions include Phoca Commander 1.0.0 through 6.1.3. The extension improperly limits filesystem paths supplied to delete, copy, and move actions. Authenticated attackers with high privileges can manipulate path parameters to reach files outside the intended directory. The flaw carries a CVSS 4.0 base score of 6.4 and impacts subsequent system confidentiality, integrity, and availability.

Critical Impact
An authenticated administrator can delete, copy, or move files outside the Joomla web root, enabling tampering with host content and potential compromise of the underlying Joomla installation.

Affected Products

Phoca Commander 1.0.0 through 6.1.3
Joomla installations using the Phoca Commander extension
Web hosts where Phoca Commander operates with elevated filesystem permissions

Discovery Timeline

2026-08-07 - CVE-2026-66493 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-66493

Vulnerability Analysis

Phoca Commander provides file management inside the Joomla administrative interface. The delete, copy, and move actions accept path parameters that identify the source or destination file. The extension fails to properly constrain these paths to the configured working directory. An attacker submitting sequences such as ../ in path parameters can traverse outside the intended root and act on arbitrary files that the web server user can access.

Because the actions include delete, copy, and move, the impact extends beyond information disclosure. An attacker can remove Joomla configuration files, overwrite templates, or relocate sensitive assets into web-accessible directories. The CVSS vector indicates that exploitation requires high privileges and no user interaction, and the subsequent system scope reflects impact beyond the vulnerable component.

Root Cause

The root cause is missing or insufficient canonicalization of user-supplied paths before filesystem operations. The extension does not validate that resolved paths remain within the permitted base directory, which is the core weakness described by [CWE-22].

Attack Vector

Exploitation occurs over the network against the Joomla administrator interface. The attacker must first authenticate with an account that can invoke Phoca Commander file operations. The attacker then submits crafted path values to delete, copy, or move endpoints, using traversal sequences to escape the configured directory.

No verified public exploit code is available. See the Phoca Commander overview for product context and update information.

Detection Methods for CVE-2026-66493

Indicators of Compromise

HTTP requests to Phoca Commander endpoints containing ../, ..\, URL-encoded traversal sequences such as %2e%2e%2f, or absolute paths in file, source, or destination parameters.
Unexpected deletion, creation, or relocation of files outside the Phoca Commander working directory, especially Joomla core files like configuration.php.
Administrator sessions performing bulk file operations from unfamiliar IP addresses or at unusual hours.

Detection Strategies

Enable Joomla and Phoca Commander action logging and alert on file operations that resolve outside the configured root directory.
Deploy web application firewall rules that inspect Phoca Commander request parameters for path traversal patterns.
Correlate administrator login events with subsequent file management actions to identify anomalous behavior.

Monitoring Recommendations

Monitor filesystem integrity for the Joomla installation directory using file integrity monitoring tools.
Review web server access logs for POST requests to administrator/index.php referencing the Phoca Commander component.
Track privileged Joomla account usage and enforce alerts on new or dormant administrator accounts performing file operations.

How to Mitigate CVE-2026-66493

Immediate Actions Required

Restrict access to the Joomla administrator interface using network controls, VPN, or IP allowlisting.
Audit Joomla accounts with permission to use Phoca Commander and remove unnecessary administrator privileges.
Back up the Joomla installation and database before applying updates or investigating suspected compromise.

Patch Information

Users should upgrade Phoca Commander to a version later than 6.1.3 once the vendor publishes a fix. Consult the Phoca Commander product page for the current release and changelog.

Workarounds

Disable or uninstall Phoca Commander until a patched version is installed.
Reduce the web server user's filesystem permissions so it cannot modify files outside the Joomla document root.
Add web application firewall rules that block requests containing path traversal sequences targeting the Phoca Commander component.

bash

# Example WAF pattern to block traversal in Phoca Commander requests
# (adapt to your WAF syntax; validate against legitimate traffic first)
SecRule REQUEST_URI "@contains option=com_phocacommander" \
  "chain,phase:2,deny,status:403,id:1026066493,msg:'Phoca Commander path traversal attempt'"
    SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" "t:none,t:lowercase,t:urlDecodeUni"