CVE-2026-90915: Joomla Core Path Traversal Vulnerability

CVE-2026-90915 Overview

CVE-2026-90915 is a path traversal vulnerability in the Joomla! Content Management System (CMS) that allows arbitrary directory deletion through the cache purge action. The flaw stems from improper validation of the cache group name in the file storage of the caching layer. An authenticated attacker with high privileges can leverage the vulnerability to traverse the file system and delete arbitrary directories on the underlying server.

The issue affects Joomla 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
An authenticated administrator can delete arbitrary directories on the server file system, leading to site defacement, denial of service, or destruction of application and system files.

Affected Products

Joomla! CMS versions 4.0.0 through 5.4.8
Joomla! CMS versions 6.0.0 through 6.1.3
Joomla file-based cache storage handler

Discovery Timeline

2026-09-29 - CVE-2026-90915 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database
Advisory - Joomla! project published Security Advisory #1085 describing the issue

Technical Details for CVE-2026-90915

Vulnerability Analysis

The vulnerability resides in the Joomla caching subsystem, specifically in the code path that processes a cache purge request. When an administrator triggers a cache purge, the caching layer maps the supplied cache group name to a directory on disk and removes its contents. Joomla failed to properly sanitize the cache group name before using it as a filesystem path.

An authenticated user with sufficient privileges can supply a crafted cache group name containing path traversal sequences such as ../. The caching layer resolves the traversal against the cache root, allowing the purge operation to target directories outside the intended cache directory. The result is deletion of arbitrary directories accessible to the web server user.

Root Cause

The root cause is missing or insufficient input validation on the cache group identifier passed to the file storage cache handler. Because the group name is used to construct a filesystem path without normalization or restriction to an allow-list of expected values, traversal metacharacters propagate into the deletion routine. This is a classic [CWE-22] path traversal weakness applied to a destructive filesystem operation.

Attack Vector

Exploitation requires network access to the Joomla administrator interface and an authenticated session with privileges to invoke the cache purge action. The attacker issues a purge request in which the cache group parameter contains path traversal sequences that escape the cache directory. No user interaction is required beyond the attacker-controlled request. Successful exploitation destroys the targeted directory, which can remove critical Joomla components, extension data, uploaded content, or portions of the web root.

No public proof-of-concept code was published at the time of writing. Refer to the Joomla Security Advisory #1085 for vendor-supplied technical details.

Detection Methods for CVE-2026-90915

Indicators of Compromise

Web server access logs containing requests to administrator cache management endpoints with parameters containing ../, encoded traversal sequences (%2e%2e%2f), or absolute paths in the cache group name.
Unexpected deletion of directories under the Joomla web root, administrator/, components/, modules/, templates/, or user-uploaded content paths.
Joomla application errors referencing missing files or directories immediately following cache purge activity.

Detection Strategies

Audit Joomla administrator activity logs for cache purge actions performed by accounts that do not normally use them.
Correlate cache purge HTTP requests with filesystem change events on the web server to identify directory removals outside the configured cache path.
Deploy web application firewall (WAF) rules that inspect cache-related administrator endpoints for path traversal patterns in query and body parameters.

Monitoring Recommendations

Enable filesystem integrity monitoring on the Joomla installation directory to alert on unexpected directory deletions.
Forward web server and Joomla application logs to a centralized analytics or SIEM platform and alert on administrator-authenticated requests containing traversal sequences.
Track authentication and privilege changes for accounts with access to cache management to detect credential compromise that could precede exploitation.

How to Mitigate CVE-2026-90915

Immediate Actions Required

Upgrade Joomla to a fixed release outside the vulnerable ranges (later than 5.4.8 in the 5.x branch and later than 6.1.3 in the 6.x branch) as published in Joomla Security Advisory #1085.
Restrict access to the Joomla administrator interface using network controls, VPN, or IP allow-listing until patches are applied.
Review administrator account inventory and remove or downgrade accounts that do not require cache management privileges.

Patch Information

The Joomla! project has released fixed versions addressing the improper cache group name validation in the file storage cache handler. Administrators should install the latest Joomla release for their branch. Consult the vendor advisory at Joomla Security Advisory #1085 for the exact fixed versions and upgrade guidance.

Workarounds

Temporarily disable the file storage cache handler and switch to an alternative cache backend that is not affected by filesystem path handling.
Enforce least-privilege on the web server process so that the account running Joomla cannot delete directories outside the intended application data paths.
Deploy WAF signatures that block requests to administrator cache endpoints containing ../, ..\, or URL-encoded traversal sequences in parameters.

bash

# Example WAF pattern to flag traversal in cache group parameters
# (adapt to your WAF syntax; test before enforcing in blocking mode)
SecRule ARGS_NAMES|ARGS "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" \
    "id:1029091,phase:2,deny,status:403,\
     msg:'Possible path traversal in Joomla cache purge (CVE-2026-90915)'"