Path Traversal Vulnerability in Joomla 6.1.1 Affects com_joomlaupdate Extension

CVE-2026-73327

What is CVE-2026-73327?

Joomla 6.1.1 introduces a path traversal vulnerability in the com_joomlaupdate extension, enabling a Super User to be tricked into executing malicious ZIP files. Attackers can exploit this flaw by crafting ZIP entry filenames with directory traversal sequences or absolute paths, allowing files to be extracted to unintended locations. This could lead to persistent remote code execution by deploying unauthorized PHP files outside the designated root directory.

References