db
database server
MariaDB 10.11 container providing the Joomla database. Configured with lab credentials and a healthcheck.
CVE-2026-66914/docker-compose.control.yml:5-18CVE-2026-66914
PoC files
14 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
Python script that exploits CVE-2026-66914, an unauthenticated path traversal vulnerability in the SEBLOD Joomla extension, to read arbitrary files from the target server.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward Python script that exploits a path traversal vulnerability in SEBLOD. It sends a single HTTP GET request with a crafted `file` parameter to read `/etc/passwd` and verifies the response. The script uses only standard library modules (`re`, `sys`, `urllib.request`, `urllib.error`) and performs no network activity beyond the declared exploit request. No obfuscation, persistence, credential theft, or unrelated payloads are present. The README and verification report document the vulnerability and lab setup without deceptive instructions.
ClassificationExploit
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a Python script that actively sends a malicious request to exploit a path traversal vulnerability to read a file from the target server. This constitutes an exploit.
poc/poc.py:1-104README.md:110-115Requirements
- Target must be running a vulnerable version of the SEBLOD Joomla extension (e.g., 3.29.0).
poc/poc.py:7 - The target's Joomla site must be reachable over HTTP.
poc/poc.py:67-68
Observed behavior
- Sends an HTTP GET request to the target's index.php with a crafted 'file' parameter containing a path traversal payload (e.g., 'tmp/../../../../etc/passwd').
poc/poc.py:75-76 - Checks if the server responds with HTTP 200 and the response body contains content matching the /etc/passwd file format.
poc/poc.py:83-84 - Prints '[SUCCESS]' and the first line of the retrieved file if exploitation is successful, or '[FAILED]' if it is not.
poc/poc.py:85-100
Behaviors behind the backdoor verdict
Observables
- Network Request
- GET /index.php?option=com_cck&task=download&file=tmp/../../../../etc/passwdThe sole network request made by the PoC to exploit the path traversal vulnerability.
poc/poc.py:75-76 - File Read
- /etc/passwdThe target file read by the exploit; a standard Linux file used for non-destructive proof of concept.
poc/poc.py:47
What the analysis did not establish
- Two binary files (assets/pkg_seblod_3.29.0b.zip and assets/pkg_seblod_3.30.0.zip) were not analyzed as per the evidence envelope's binary policy.
- The analysis is based solely on the provided text files and does not include dynamic execution or verification of the exploit code.
- Two binary zip files (assets/pkg_seblod_3.29.0b.zip and assets/pkg_seblod_3.30.0.zip) were not analyzed; they are described as the vulnerable and patched SEBLOD packages and are not executed by the PoC.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
2GitHubCVE-2026-66914/docker-compose.control.yml
Created Vuln labCVE-2026-66914Compose · mixed
Analysis
Environment assessment
A Docker Compose environment that builds a Joomla 4.4 web server with the SEBLOD 3.30.0 extension installed, intended as a patched control for a path-traversal vulnerability lab (CVE-2026-66914).
CVE-2026-66914/docker-compose.control.yml:1-2CVE-2026-66914/Dockerfile.patched:1Lab assessment
Vulnerability labThe README explicitly describes a vulnerability lab for CVE-2026-66914, and the control Compose file and Dockerfile are part of a paired vulnerable/patched setup for demonstrating the path-traversal vulnerability.
CVE-2026-66914/README.md:1-3CVE-2026-66914/docker-compose.control.yml:1-2Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
web
web serverJoomla applicationSEBLOD extension host
Apache web server built from joomla:4.4-apache with the patched SEBLOD 3.30.0 extension installed. Exposes port 80 on a configurable host port (default 8781). Contains lab canary files for traversal evidence and a seed script for automated setup.
CVE-2026-66914/docker-compose.control.yml:20-37CVE-2026-66914/Dockerfile.patched:1-21lab-seed.sh
automated setup script
Shell script copied into the web container that installs Joomla via CLI and then installs the SEBLOD package via a web-UI helper script. Runs inside the container after startup.
CVE-2026-66914/Dockerfile.patched:5CVE-2026-66914/seed.sh:1-46web-install.php
SEBLOD web-UI installer
PHP script that logs into the Joomla administrator panel and installs the SEBLOD library and package via the web interface, working around CLI limitations. Runs inside the web container.
CVE-2026-66914/Dockerfile.patched:6CVE-2026-66914/web-install.php:1-113How the supplied evidence relates each vulnerability
CVE-2026-66914
Supported by supplied evidence
The README, PoC script, and verification report all describe and demonstrate an unauthenticated path-traversal vulnerability in SEBLOD, and the control environment is explicitly built with the patched version (3.30.0) to show the fix.
CVE-2026-66914/README.md:1-3CVE-2026-66914/poc/poc.py:1-4CVE-2026-66914/poc_verification_report.md:1-2Requirements and sequence described by the evidence
Prerequisites
- Docker Engine with Compose plugin
CVE-2026-66914/README.md:82-84 - Network access to Docker Hub for base images
CVE-2026-66914/README.md:84 - SEBLOD package zip files vendored in assets/
CVE-2026-66914/README.md:84
Evidence-described exercise path
- Build and start the control environment: docker compose -p cve-2026-66914-control -f docker-compose.control.yml up -d --build
CVE-2026-66914/docker-compose.control.yml:2 - Run the seed script inside the web container to install Joomla and SEBLOD: docker compose -p cve-2026-66914-control -f docker-compose.control.yml exec web bash /usr/local/bin/lab-seed.sh
CVE-2026-66914/docker-compose.control.yml:3 - Run the PoC against the control environment to verify the fix: python3 poc/poc.py http://127.0.0.1:8781
CVE-2026-66914/README.md:100-101
Behaviors behind the stored safety assessment
No harmful behavior observed
The control environment is a self-contained lab that only exposes a web service on a configurable host port. The PoC targets the lab's own web server to demonstrate the vulnerability fix; no behavior escapes the container boundary, persists beyond the lab, steals credentials, or destroys data outside the intended lab target.
CVE-2026-66914/docker-compose.control.yml:20-37CVE-2026-66914/poc/poc.py:1-104What the analysis did not establish
- The packet includes only the control (patched) Compose file and Dockerfile; the vulnerable counterparts (docker-compose.yml, Dockerfile.vulnerable) are present in the file inventory but not included as evidence text.
- The SEBLOD zip files are binary and uninspected.
- The PoC script is present but its behavior is only described, not executed in this analysis.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
GitHubCVE-2026-66914/docker-compose.yml
Created Vuln labCVE-2026-66914Compose · mixed
Analysis
Environment assessment
A Docker Compose environment for demonstrating CVE-2026-66914, an unauthenticated path traversal vulnerability in the SEBLOD Joomla extension. It consists of a MariaDB database service and a web service built from a custom Dockerfile that installs Joomla 4.4 and the vulnerable SEBLOD 3.29.0b package.
CVE-2026-66914/docker-compose.yml:1-42CVE-2026-66914/Dockerfile.vulnerable:1-21CVE-2026-66914/README.md:1-131Lab assessment
Vulnerability labThe README explicitly describes the environment as a 'Vulnerable environment' for CVE-2026-66914, provides a vulnerability summary, root cause analysis, and PoC usage instructions. The Dockerfile installs the vulnerable SEBLOD version and creates canary files for traversal evidence. The compose file orchestrates the vulnerable web and database services.
CVE-2026-66914/README.md:1-2CVE-2026-66914/README.md:5-18CVE-2026-66914/Dockerfile.vulnerable:1-21Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
db
database server
A MariaDB 10.11 container that stores Joomla data. It is configured with strict SQL mode disabled to accommodate SEBLOD 3.x seed SQL. It exposes no ports to the host and uses a named volume for persistence.
CVE-2026-66914/docker-compose.yml:4-19web
vulnerable web application server
A custom-built container based on joomla:4.4-apache that includes the vulnerable SEBLOD 3.29.0b extension. It copies seed scripts and a web installer, creates canary files for traversal testing, and patches the Joomla DB driver to remove strict mode. It exposes port 80 mapped to host port 8780.
CVE-2026-66914/docker-compose.yml:21-37CVE-2026-66914/Dockerfile.vulnerable:1-21seed.sh
lab initialization script
A shell script that runs inside the web container to install Joomla via CLI and then install the SEBLOD package via a web-based installer. It waits for Apache to be ready before proceeding.
CVE-2026-66914/seed.sh:1-46web-install.php
SEBLOD web-based installer
A PHP script that performs a web-based installation of the SEBLOD package because its postflight requires a web application context. It logs into the Joomla administrator, extracts the package, and installs the library and component in the correct order.
CVE-2026-66914/web-install.php:1-113poc.py
proof-of-concept exploit
A Python script that demonstrates the CVE-2026-66914 path traversal by requesting /etc/passwd through the vulnerable download task. It verifies the response content and reports success or failure.
CVE-2026-66914/poc/poc.py:1-104How the supplied evidence relates each vulnerability
CVE-2026-66914
Supported by supplied evidence
The README, PoC script, and verification report all describe and demonstrate an unauthenticated path traversal in SEBLOD's download task. The Dockerfile installs the vulnerable version 3.29.0b, and the PoC targets the exact vulnerable endpoint. The verification report confirms successful exploitation against the lab's vulnerable build and failure against a patched control.
CVE-2026-66914/README.md:5-18CVE-2026-66914/poc/poc.py:1-104CVE-2026-66914/poc_verification_report.md:1-17Requirements and sequence described by the evidence
Prerequisites
- Docker Engine with Compose plugin
CVE-2026-66914/README.md:82-83 - Network access to Docker Hub for base images
CVE-2026-66914/README.md:84 - The SEBLOD package zip (pkg_seblod_3.29.0b.zip) must be present in the assets/ directory
CVE-2026-66914/Dockerfile.vulnerable:4
Evidence-described exercise path
- Build and start the vulnerable environment: docker compose up -d --build
CVE-2026-66914/README.md:95 - Seed the lab: docker compose exec web bash /usr/local/bin/lab-seed.sh
CVE-2026-66914/README.md:96 - Run the PoC against the vulnerable build: python3 poc/poc.py http://127.0.0.1:8780
CVE-2026-66914/README.md:103 - Optionally run the PoC against a patched control build to observe the fix.
CVE-2026-66914/README.md:104
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is directed at the contained lab target. The PoC reads /etc/passwd from within the vulnerable container and does not attempt to escape the container, access the host, or connect to external systems. The delete-after-read side effect is documented and demonstrated only on lab-owned canary files inside the container. No hidden, destructive, or backdoor behavior is present.
CVE-2026-66914/poc/poc.py:1-104CVE-2026-66914/poc_verification_report.md:1-17CVE-2026-66914/Dockerfile.vulnerable:10-14What the analysis did not establish
- The packet does not include the contents of the SEBLOD zip files (pkg_seblod_3.29.0b.zip and pkg_seblod_3.30.0.zip), which are binary and uninspected.
- The control environment (docker-compose.control.yml and Dockerfile.patched) is referenced but not included in the evidence files, so the patched build cannot be fully assessed.
- The PoC script is not executed; only its source code is analyzed.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.