Authenticated Remote Code Execution in Phoca Commander for Joomla
CVE-2025-54473

9.2CRITICAL

Key Information:

Vendor

Phoca.cz

Status
Phoca.cz - Phoca Commander For Joomla
Vendor
CVE Published:
15 August 2025

What is CVE-2025-54473?

A security flaw has been identified in the Phoca Commander component for Joomla, which allows authenticated users to execute arbitrary code remotely through an exploitation of the unzip feature. Versions 1.0.0 to 4.0.0 and 5.0.0 to 5.0.1 are susceptible to this vulnerability, posing a significant risk to Joomla installations utilizing this component. Users are urged to review their configurations and apply necessary updates to mitigate the potential for unauthorized access and exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

phoca.cz - Phoca Commander for Joomla 5.0.0-5.0.1

phoca.cz - Phoca Commander for Joomla 1.0.0-4.0.0

References

https://phoca.cz/
product

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian Jeż
JSON
.