CVE-2026-73327: Joomla Path Traversal Vulnerability

CVE-2026-73327 Overview

CVE-2026-73327 is a path traversal vulnerability [CWE-22] in Joomla 6.1.1. The flaw resides in the com_joomlaupdate extension, specifically in the extract.php extraction routine. Attackers can craft ZIP archives whose entries contain parent-directory sequences or absolute paths. When a Super User is induced into extracting the malicious archive, files are written outside the intended destination root. This enables persistent remote code execution through planted PHP files inside the web root.

Critical Impact
A social-engineered Super User can be tricked into extracting a crafted update archive, resulting in arbitrary file write outside the destination directory and persistent remote code execution on the Joomla host.

Affected Products

Joomla CMS 6.1.1
com_joomlaupdate administrator component
administrator/components/com_joomlaupdate/extract.php

Discovery Timeline

2026-08-12 - CVE-2026-73327 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73327

Vulnerability Analysis

The vulnerability is a classic Zip Slip pattern in the Joomla update extraction routine. extract.php in com_joomlaupdate iterates through ZIP archive entries and writes them under the Joomla installation directory. The extraction logic fails to reliably reject entry names that contain directory traversal sequences such as ../ or absolute paths beginning with / or a drive letter. As a result, a crafted archive can place files at attacker-chosen locations on the server filesystem. Because Joomla executes PHP inside its web root, an attacker who writes a PHP file into a web-served directory gains persistent code execution under the web server account.

Root Cause

The isPathTraversalAttempt() helper in extract.php did not correctly detect all unsafe entry names. Entry filenames read directly from the archive were normalized and joined to the destination root without a strict containment check against the resolved base path. This is a canonical instance of [CWE-22], improper limitation of a pathname to a restricted directory.

Attack Vector

Exploitation requires a Super User to trigger the update extraction with an attacker-supplied archive. The user interaction requirement and high privilege prerequisite raise attack complexity, but successful exploitation yields code execution, integrity loss, and full site compromise. The archive can be delivered through a phishing lure directing a Joomla administrator to run a fake update.

php

     * @param   string  $filename  The raw entry name as read from the archive
     *
     * @return  boolean  True if the entry name is unsafe to use as-is
-    * @since   4.2.9
+    * @since   __DEPLOY_VERSION__
     */
    private function isPathTraversalAttempt(string $filename): bool
    {
// Source: https://github.com/joomla/joomla-cms/commit/9678a171d37e1e10ca75c9124bdafe20fe14fa5b
// This patch hardens isPathTraversalAttempt() in extract.php to reject unsafe ZIP entry names.

Detection Methods for CVE-2026-73327

Indicators of Compromise

Unexpected .php files appearing under administrator/components/, components/, templates/, or the Joomla web root after an update action.
Recent modifications to files outside administrator/components/com_joomlaupdate/restore/ following an extraction event.
ZIP archives uploaded to tmp/ containing entries with ../ sequences or absolute path prefixes.
Web server processes spawning shell interpreters (sh, bash, cmd.exe) shortly after a Joomla update workflow.

Detection Strategies

Inspect archives staged for com_joomlaupdate and enumerate entry names for traversal sequences before extraction.
Baseline Joomla installation file hashes and alert on file creation events under the web root that do not match the shipped release manifest.
Correlate POST requests to administrator/index.php?option=com_joomlaupdate with subsequent PHP file writes on disk.

Monitoring Recommendations

Enable filesystem auditing on the Joomla document root and the administrator/ tree.
Log and review Super User session activity, especially update and extension install operations.
Alert on outbound connections initiated by the PHP-FPM or Apache worker following an update workflow.

How to Mitigate CVE-2026-73327

Immediate Actions Required

Upgrade Joomla to a version that includes the fix from GitHub Pull Request #48057.
Restrict Super User accounts and enforce multi-factor authentication for administrator logins.
Audit the web root for unauthorized PHP files added since the last known-good backup and restore as needed.
Rotate credentials, API tokens, and database secrets on any host suspected of compromise.

Patch Information

The fix is delivered in the Joomla CMS repository via commit 9678a171d37e1e10ca75c9124bdafe20fe14fa5b, which strengthens isPathTraversalAttempt() in administrator/components/com_joomlaupdate/extract.php. See the GitHub Commit Evasion Fix, the GitHub Joomla CMS Repository, and the VulnCheck Advisory on Joomla Zip Slip for full technical detail.

Workarounds

Only extract update packages downloaded directly from official Joomla release channels over HTTPS.
Block administrator access to the Joomla backend from untrusted networks using a web application firewall or IP allowlist.
Set the web server user to read-only on directories that should never receive new PHP files, such as libraries/ and templates/.

bash

# Restrict write access on sensitive Joomla directories (adjust user/group as needed)
find /var/www/joomla/libraries -type d -exec chmod 555 {} \;
find /var/www/joomla/libraries -type f -exec chmod 444 {} \;
chown -R root:www-data /var/www/joomla/administrator/components/com_joomlaupdate