CVE-2026-75115: YOOtheme Pro Path Traversal Vulnerability

CVE-2026-75115 Overview

CVE-2026-75115 is an authenticated arbitrary file read vulnerability in the YOOtheme Pro extension for Joomla. The flaw resides in the Filesystem source's path filter, which fails to properly validate glob-based patterns. Authorized users with elevated privileges can bypass the filter to read arbitrary files on the underlying server. The issue affects YOOtheme Pro versions 2.3.0 through 5.0.40 and is classified as a path traversal weakness [CWE-22].

Critical Impact
Privileged Joomla users can read sensitive server files, including configuration files containing database credentials and cryptographic secrets.

Affected Products

YOOtheme Pro for Joomla 2.3.0 through 5.0.40
Joomla sites using the YOOtheme Pro Filesystem source feature
Multi-tenant Joomla deployments with delegated administrative roles

Discovery Timeline

2026-08-21 - CVE-2026-75115 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75115

Vulnerability Analysis

The YOOtheme Pro builder exposes a Filesystem source that lets authorized users reference files by path. The extension applies a path filter to restrict which files are accessible. That filter interprets patterns using glob semantics rather than strict path canonicalization. Attackers supply wildcard characters such as *, ?, and [...] to expand matches beyond the intended directory scope.

Because the filter operates on the pre-resolved pattern rather than the resolved absolute path, an authorized user can craft patterns that traverse outside the configured directory. The server then returns the contents of matched files to the requesting session. This exposes sensitive artifacts such as configuration.php, .env files, private keys, and log data.

Root Cause

The root cause is insufficient validation of user-controlled path patterns in the Filesystem source handler. The extension trusts glob expansion to stay within a boundary directory but does not enforce a canonical prefix check on each expanded match. This is a classic path traversal pattern implemented through wildcard expansion rather than ../ sequences.

Attack Vector

Exploitation requires network access to the Joomla administrative interface and an authenticated account with high privileges to configure or invoke the YOOtheme Pro Filesystem source. The attacker submits a crafted glob pattern through the builder, and the server returns file contents that fall outside the intended directory. No user interaction beyond the attacker's own session is required. See the YOOtheme Official Website for vendor advisories and release notes.

Detection Methods for CVE-2026-75115

Indicators of Compromise

Requests to YOOtheme Pro builder endpoints containing glob metacharacters such as *, ?, or [ in path parameters.
Access log entries showing successful reads of files outside the site's web root or media directories.
Unexpected Filesystem source configurations referencing paths like /etc/, /var/, or parent directories.
Administrator accounts issuing repeated Filesystem source queries with varying wildcard patterns.

Detection Strategies

Inspect Joomla and web server access logs for YOOtheme Pro endpoints receiving parameters that include shell-style wildcards.
Correlate authenticated administrative sessions with file-read operations that touch sensitive paths such as configuration.php.
Baseline normal Filesystem source usage per administrator, then alert on deviations in file paths or query volume.

Monitoring Recommendations

Forward Joomla application logs and web server logs to a centralized analytics platform for retention and correlation.
Monitor for privileged Joomla account activity outside expected maintenance windows.
Alert when files matching configuration.php, *.env, or id_rsa* are accessed through HTTP responses.

How to Mitigate CVE-2026-75115

Immediate Actions Required

Upgrade YOOtheme Pro to a version later than 5.0.40 that addresses the path filter flaw.
Audit Joomla administrator and Super User accounts and remove unused or excess privileges.
Rotate credentials and secrets stored in files that may have been exposed through the Filesystem source.
Review recent Filesystem source configurations for unauthorized path patterns.

Patch Information

Refer to the YOOtheme Official Website for the fixed release and vendor guidance. Apply the vendor-provided update to all Joomla sites running YOOtheme Pro 2.3.0 through 5.0.40.

Workarounds

Restrict access to the YOOtheme Pro builder to a limited set of trusted administrators using Joomla ACL.
Place the Joomla administrative interface behind a VPN or IP allowlist to reduce exposure.
Enforce web server filesystem permissions so the PHP process cannot read sensitive files such as private keys.
Enable multi-factor authentication for all privileged Joomla accounts to reduce the risk of account takeover.

bash

# Configuration example: restrict admin access at the web server layer
# Apache example - limit /administrator to trusted networks
<Location "/administrator">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>