CVE-2026-76611: YOOtheme Zoo Path Traversal Vulnerability

CVE-2026-76611 Overview

CVE-2026-76611 is a path traversal vulnerability [CWE-22] in the YOOtheme Zoo extension for Joomla. The flaw resides in the Gallery element and allows unauthenticated attackers to enumerate arbitrary directory contents on the web server. Affected installations run Zoo versions prior to 4.1.66. Attackers reach the vulnerable component over the network without authentication or user interaction, making reconnaissance straightforward against exposed Joomla sites.

Critical Impact
Unauthenticated remote attackers can list arbitrary directories on the underlying server, exposing file names, backup archives, and configuration artifacts that support further attacks.

Affected Products

YOOtheme Zoo (Joomla extension) versions prior to 4.1.66
Joomla sites using the Zoo Gallery element
YOOtheme-powered Joomla deployments distributing content via Zoo

Discovery Timeline

2026-08-21 - CVE-2026-76611 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76611

Vulnerability Analysis

The vulnerability affects the Gallery element inside the Zoo component for Joomla. Zoo is a content application builder distributed by YOOtheme. The Gallery element accepts a directory parameter to enumerate image files. Insufficient validation of that parameter lets attackers escape the intended media directory. The result is directory listing of paths anywhere the web process can read.

Exploitation does not require authentication or interaction. An attacker issues a crafted HTTP request against a Joomla site that renders a Zoo Gallery element. The server returns names of files inside the requested path. Successful enumeration exposes backup files, credentials in configuration folders, and other sensitive artifacts that accelerate follow-on attacks against the site.

The issue is limited to information exposure. It does not directly grant code execution or write access. The impact aligns with reconnaissance and integrity-adjacent risks, since disclosed paths often enable targeted exploitation of related weaknesses.

Root Cause

The Gallery element concatenates user-controlled directory input into a filesystem path without normalizing traversal sequences such as ../. The code trusts input that should be constrained to an allowlisted media root. This pattern maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Attackers send unauthenticated HTTP requests that specify a traversal payload in the Gallery parameter handling directory selection. The vulnerable code resolves the path relative to the Joomla webroot and returns directory entries. No credentials, tokens, or user interaction are needed.

Refer to the YOOtheme Official Website for vendor advisory information and release notes describing the fix in Zoo 4.1.66.

Detection Methods for CVE-2026-76611

Indicators of Compromise

HTTP requests to Joomla endpoints rendering Zoo Gallery elements that contain ../ sequences or absolute paths in query parameters.
Repeated requests from a single source enumerating variations of directory parameters against /index.php?option=com_zoo URLs.
Access log entries showing directory-name responses returned to unauthenticated clients.

Detection Strategies

Inventory Joomla sites and identify installations of the Zoo extension with versions below 4.1.66.
Deploy Web Application Firewall (WAF) rules that block traversal patterns in query parameters targeting com_zoo routes.
Review web server access logs for anomalous parameter values referencing filesystem paths outside the media root.

Monitoring Recommendations

Alert on outbound responses containing directory listings served from Joomla endpoints.
Correlate reconnaissance activity against Zoo endpoints with subsequent requests to disclosed paths.
Track file-access telemetry on Joomla hosts for reads originating from the web server process outside expected content directories.

How to Mitigate CVE-2026-76611

Immediate Actions Required

Upgrade the Zoo extension to version 4.1.66 or later on all Joomla instances.
Restrict internet exposure of Joomla administration and content endpoints until the patch is applied.
Audit web server logs for evidence of directory-enumeration attempts against Zoo Gallery URLs.

Patch Information

YOOtheme addresses this vulnerability in Zoo 4.1.66. Download the current release from the YOOtheme Official Website and follow the standard Joomla extension update procedure. Verify the installed version through the Joomla Extensions Manager after upgrade.

Workarounds

Disable the Zoo Gallery element on affected sites until the upgrade completes.
Apply WAF signatures that reject path-traversal characters in com_zoo parameters.
Constrain filesystem permissions so the web server account cannot read directories outside the Joomla webroot.

bash

# Example WAF rule concept for blocking traversal in Zoo Gallery requests
SecRule REQUEST_URI "@contains com_zoo" \
    "chain,deny,status:403,id:1026761,msg:'Zoo Gallery path traversal attempt'"
SecRule ARGS "@rx \.\./" "t:none,t:urlDecodeUni"