Description

Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be written outside the intended destination root and enabling persistent remote code execution via planted PHP files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-12T18:18:15.480Z",
  "pubdate": "2026-08-12T18:18:15.480Z",
  "executiveSummary": "Joomla 6.1.1 suffers from a critical path traversal vulnerability residing within the com_joomlaupdate extension. This security flaw enables a Super User to be manipulated into processing a maliciously crafted archive. Consequently, attackers can leverage directory traversal sequences or absolute paths embedded within ZIP entry filenames to bypass intended boundary restrictions during the extraction process.\nThe primary impact of this vulnerability is the arbitrary writing of files outside the designated destination root directory. By planting malicious PHP files into accessible web directories, an attacker achieves persistent remote code execution on the underlying server. Exploitation requires administrative-level privileges, specifically a Super User capability, to initiate the update or archive extraction process, along with social engineering or prior compromise to supply the crafted archive.",
  "technicalDetails": "The vulnerability exists within the extract.php extraction routine utilized by the com_joomlaupdate extension in Joomla 6.1.1. The root cause is the insufficient sanitization and validation of ZIP entry filenames during archive decompression. When the application iterates through the archive entries, it fails to adequately check for parent-directory traversal sequences (such as ../) or absolute path indicators.\nThe attack flow proceeds as follows: an attacker crafts a malicious ZIP archive containing entries with specially manipulated filenames that incorporate directory traversal patterns or absolute file paths. This payload is then supplied to the update routine, typically handled by the extract.php script. Because the routine trusts the internal metadata of the ZIP archive without enforcing strict destination root containment, the file writing mechanism resolves the traversal sequences and writes the payload to arbitrary locations on the filesystem.\nAuthentication and privilege requirements dictate that the victim must possess Super User privileges within the Joomla administrative interface to trigger the vulnerable update or extraction mechanism. Network exposure is dependent on the accessibility of the Joomla administrator panel. Post-exploitation impact includes persistent remote code execution resulting from the successful planting of malicious PHP web shells or backdoor scripts into web-accessible directories, thereby compromising the entire CMS and potentially the host operating system."
}