Authenticated Remote Code Execution in Phoca Commander for Joomla
CVE-2025-54473

9.2CRITICAL

Key Information:

Vendor

Phoca.cz

Status
Phoca.cz - Phoca Commander For Joomla
Vendor
CVE Published:
15 August 2025

What is CVE-2025-54473?

A security flaw has been identified in the Phoca Commander component for Joomla, which allows authenticated users to execute arbitrary code remotely through an exploitation of the unzip feature. Versions 1.0.0 to 4.0.0 and 5.0.0 to 5.0.1 are susceptible to this vulnerability, posing a significant risk to Joomla installations utilizing this component. Users are urged to review their configurations and apply necessary updates to mitigate the potential for unauthorized access and exploitation.

Affected Version(s)

phoca.cz - Phoca Commander for Joomla 5.0.0-5.0.1

phoca.cz - Phoca Commander for Joomla 1.0.0-4.0.0

References

https://phoca.cz/
product

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian JeĹĽ
.
CVE-2025-54473 : Authenticated Remote Code Execution in Phoca Commander for Joomla