CVE-2026-73327

Published: Ago 12, 2026 Last Modified: Ago 12, 2026

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,7

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: high

User Interaction: active

Confidentiality: N/A

Integrity: N/A

Availability: N/A

HIGH 7,6

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: high

User Interaction: required

Scope: changed

Confidentiality: high

Integrity: high

Availability: high

Description

AI Translation Available

Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be written outside the intended destination root and enabling persistent remote code execution via planted PHP files.