CVE-2026-97164: Joomla Event Gallery Path Traversal Flaw

CVE-2026-97164 Overview

CVE-2026-97164 is a path traversal vulnerability [CWE-22] in the Event Gallery extension for Joomla, developed by svenbluege.de. Versions prior to 6.5.0 are affected. The flaw resides in the cache.process task, where the images parameter accepts attacker-controlled paths without proper validation. An authenticated attacker with high privileges can recursively delete any directory that the web server user has write access to. Successful exploitation leads to loss of integrity and availability of files on the host, including application source files, uploaded content, and operating system resources accessible to the web process.

Critical Impact
Authenticated attackers can recursively delete arbitrary directories writable by the web server, enabling destruction of Joomla content, user uploads, and other filesystem data.

Affected Products

Joomla Event Gallery extension by svenbluege.de
All versions prior to 6.5.0
Joomla installations with the vulnerable extension enabled

Discovery Timeline

2026-09-27 - CVE-2026-97164 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97164

Vulnerability Analysis

The vulnerability exists in the clear cache functionality exposed through the cache.process task of the Event Gallery extension. The handler accepts an images request parameter that identifies cached image paths to purge. The extension does not canonicalize or validate this parameter against the intended cache directory. As a result, directory traversal sequences in the input are followed when the deletion routine recursively walks and removes the target path. Any directory writable by the web server process becomes a valid deletion target, including Joomla configuration directories, media libraries, and other application data stored on the same filesystem.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The images parameter is passed directly to a recursive delete operation without enforcing a base-directory constraint, normalizing .. sequences, or verifying that the resolved path remains within the intended cache location.

Attack Vector

Exploitation requires network access to the Joomla site and an authenticated session with high privileges, consistent with the CVSS vector PR:H. The attacker submits a request to the cache.process task with a crafted images parameter pointing outside the extension's cache directory. The server-side handler then recursively deletes the resolved path. No user interaction is required beyond the attacker's own authenticated request. Refer to the Sven Bluege Portfolio for vendor information.

Detection Methods for CVE-2026-97164

Indicators of Compromise

Web server access log entries invoking task=cache.process with an images parameter containing ../, absolute paths, or references outside the Event Gallery cache directory.
Unexpected disappearance of files or directories within the Joomla webroot, media library, or sibling application directories.
Error log entries from Joomla or PHP indicating missing files, broken includes, or failed component initialization following suspicious administrative activity.

Detection Strategies

Review Joomla administrator audit logs for authenticated users invoking cache.process outside of normal maintenance windows.
Correlate HTTP requests targeting the Event Gallery component with filesystem change events captured by host integrity monitoring.
Alert on any HTTP parameter value that includes traversal patterns such as ..%2f, ..\, or absolute paths when submitted to Joomla component endpoints.

Monitoring Recommendations

Enable file integrity monitoring on the Joomla webroot and shared storage used by the web server account.
Forward web server, PHP, and Joomla application logs to a central analytics platform for correlation with authentication events.
Track administrator and manager account activity for unusual task invocations against third-party extensions.

How to Mitigate CVE-2026-97164

Immediate Actions Required

Upgrade the Event Gallery extension to version 6.5.0 or later on all affected Joomla sites.
Audit Joomla administrator, manager, and super user accounts, and remove or disable accounts that are no longer required.
Review backups and filesystem contents to confirm no unauthorized deletions have occurred.

Patch Information

The vendor has addressed the issue in Event Gallery 6.5.0. Site operators should download the fixed release from the Event Gallery product page and apply it through the Joomla Extension Manager. Verify the installed version in the Joomla administrator panel after upgrade. See the Sven Bluege Portfolio for release details.

Workarounds

Temporarily disable the Event Gallery component in the Joomla Extension Manager until the patch is applied.
Restrict access to the Joomla administrator interface using IP allowlists or a web application firewall rule set.
Block HTTP requests to the Joomla index.php endpoint when the query string combines task=cache.process with path traversal sequences in the images parameter.

bash

# Example WAF rule concept - block traversal in the images parameter
# ModSecurity-style pseudo-rule
SecRule ARGS:task "@streq cache.process" \
    "chain,phase:2,deny,status:403,id:1026097164,\
     msg:'CVE-2026-97164 Event Gallery path traversal attempt'"
    SecRule ARGS:images "@rx (\.\./|\.\.\\|%2e%2e%2f|^/)"