CVE-2026-40384

HIGH

Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint

Title source: cna

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

Core 1

Core References

Vendor Advisory vendor-advisory

CVSS v3 7.5

EPSS 0.0044

EPSS Percentile 35.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

CWE

CWE-22

Status published

Products (3)

joomla/joomla\! 4.0.0 - 5.4.6

Joomla! Project/Joomla! CMS 4.0.0-5.4.5

Joomla! Project/Joomla! CMS 6.0.0-6.1.0

Published May 26, 2026

Tracked Since May 26, 2026