Executive brief
Joomla!, a popular website management system, contains a security flaw that could allow an administrative user to access sensitive files on the server. By exploiting this vulnerability, an attacker could potentially read configuration files or system data, leading to a full compromise of the website and its underlying data. Organizations should update their Joomla! installations to the latest patched versions to prevent unauthorized file access.
Technical details
A local file inclusion (LFI) vulnerability exists in the Joomla! CMS core due to improper validation of user-supplied input within the HTMLView layout parameter. An attacker with high privileges (administrative access) can exploit this by providing a crafted path to the layout parameter, leading to the inclusion and execution of local files on the server. This is classified as a path traversal issue (CWE-22). The vulnerability affects versions 3.2.1 through 5.4.5 and 6.0.0 through 6.1.0. It has been addressed in versions 5.4.6 and 6.1.1.
Affected products
- Joomla! CMS 3.2.1-5.4.5, 6.0.0-6.1.0
Timeline
- 2026-04-15: disclosed: Reported by Doyensec in collaboration with Claude and Anthropic Research
- 2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
- 2026-05-26: advisory