Authenticated Path Traversal in jDownloads by Joomla
CVE-2026-117542

5.1MEDIUM

Key Information:

Vendor

Jdownloads.com

Status
Jdownloads Extension For Joomla
Vendor
CVE Published:
12 November 2026

What is CVE-2026-117542?

A vulnerability in the jDownloads Joomla extension allows an authenticated user to perform a path traversal attack by manipulating the update_file form parameter. This exploitation can lead to unauthorized file access, circumventing intended server-file selection restrictions. As a result, sensitive files outside the designated directory may be accessed or relocated, potentially compromising file contents and disrupting original file structure.

Affected Version(s)

jDownloads extension for Joomla 1.0.0-4.1.7

References

https://www.jdownloads.com/
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Łukasz Rybak
.