CVE-2026-66914: Joomla Extension

Record summary

CVE-2026-66914 has a selected CVSS score of 9.2 (critical); EIP currently links 1 curated repository PoC and 2 lab environments.

Description

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs: 1
Lab environments: 2

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 7, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
SEBLOD extension for Joomla Browse seblod.com / SEBLOD extension for Joomla Default status: unaffected	CVE List	1.0.0-3.29.0	affected
		4.0.0-4.6.0	affected
		5.0.0-6.0.0	affected

Proofs of concept

Curated repository PoCs

GitHubCVE-2026-66914Curated repository PoCby exploitintel8Exploit14 files

C · 4.8 MiB

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

Python script that exploits CVE-2026-66914, an unauthenticated path traversal vulnerability in the SEBLOD Joomla extension, to read arbitrary files from the target server.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that exploits a path traversal vulnerability in SEBLOD. It sends a single HTTP GET request with a crafted `file` parameter to read `payload withheld` and verifies the response. The script uses only standard library modules (`re`, `sys`, `urllib.request`, `urllib.error`) and performs no network activity beyond the declared exploit request. No obfuscation, persistence, credential theft, or unrelated payloads are present. The README and verification report document the vulnerability and lab setup without deceptive instructions.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesPython

Target softwareSEBLOD extension for Joomla

Attack typesPath TraversalArbitrary File Read

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Python script that actively sends a malicious request to exploit a path traversal vulnerability to read a file from the target server. This constitutes an exploit.

poc/poc.py:1-104README.md:110-115

Requirements

Target must be running a vulnerable version of the SEBLOD Joomla extension (e.g., 3.29.0).poc/poc.py:7
The target's Joomla site must be reachable over HTTP.poc/poc.py:67-68

Observed behavior

Sends an HTTP GET request to the target's index.php with a crafted 'file' parameter containing a path traversal payload (e.g., 'tmp/../../../..payload withheld').poc/poc.py:75-76
Checks if the server responds with HTTP 200 and the response body contains content matching the payload withheld file format.poc/poc.py:83-84
Prints '[SUCCESS]' and the first line of the retrieved file if exploitation is successful, or '[FAILED]' if it is not.poc/poc.py:85-100

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request: Payload withheldThe sole network request made by the PoC to exploit the path traversal vulnerability.poc/poc.py:75-76
File Read: Payload withheldThe target file read by the exploit; a standard Linux file used for non-destructive proof of concept.poc/poc.py:47

Review boundaries

What the analysis did not establish

Two binary files (assets/pkg_seblod_3.29.0b.zip and assets/pkg_seblod_3.30.0.zip) were not analyzed as per the evidence envelope's binary policy.
The analysis is based solely on the provided text files and does not include dynamic execution or verification of the exploit code.
Two binary zip files (assets/pkg_seblod_3.29.0b.zip and assets/pkg_seblod_3.30.0.zip) were not analyzed; they are described as the vulnerable and patched SEBLOD packages and are not executed by the PoC.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-66914/docker-compose.control.yml

CVE-2026-66914Created 2026-05-19Vuln labCVE-2026-66914Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Environment assessment

A Docker Compose environment that builds a Joomla 4.4 web server with the SEBLOD 3.30.0 extension installed, intended as a patched control for a path-traversal vulnerability lab (CVE-2026-66914).

CVE-2026-66914/docker-compose.control.yml:1-2CVE-2026-66914/Dockerfile.patched:1

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability lab for CVE-2026-66914, and the control Compose file and Dockerfile are part of a paired vulnerable/patched setup for demonstrating the path-traversal vulnerability.

CVE-2026-66914/README.md:1-3CVE-2026-66914/docker-compose.control.yml:1-2

Lab shapeCompose · mixed

Services2

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

db

database server

MariaDB 10.11 container providing the Joomla database. Configured with lab credentials and a healthcheck.

CVE-2026-66914/docker-compose.control.yml:5-18

web

web serverJoomla applicationSEBLOD extension host

Apache web server built from joomla:4.4-apache with the patched SEBLOD 3.30.0 extension installed. Exposes port 80 on a configurable host port (default 8781). Contains lab canary files for traversal evidence and a seed script for automated setup.

CVE-2026-66914/docker-compose.control.yml:20-37CVE-2026-66914/Dockerfile.patched:1-21

lab-seed.sh

automated setup script

Shell script copied into the web container that installs Joomla via CLI and then installs the SEBLOD package via a web-UI helper script. Runs inside the container after startup.

CVE-2026-66914/Dockerfile.patched:5CVE-2026-66914/seed.sh:1-46

web-install.php

SEBLOD web-UI installer

PHP script that logs into the Joomla administrator panel and installs the SEBLOD library and package via the web interface, working around CLI limitations. Runs inside the web container.

CVE-2026-66914/Dockerfile.patched:6CVE-2026-66914/web-install.php:1-113

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-66914

Supported by supplied evidence

The README, PoC script, and verification report all describe and demonstrate an unauthenticated path-traversal vulnerability in SEBLOD, and the control environment is explicitly built with the patched version (3.30.0) to show the fix.

CVE-2026-66914/README.md:1-3CVE-2026-66914/poc/poc.py:1-4CVE-2026-66914/poc_verification_report.md:1-2

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker Engine with Compose pluginCVE-2026-66914/README.md:82-84
Network access to Docker Hub for base imagesCVE-2026-66914/README.md:84
SEBLOD package zip files vendored in assets/CVE-2026-66914/README.md:84

Evidence-described exercise path

Build and start the control environment: docker compose -p cve-2026-66914-control -f docker-compose.control.yml up -d --buildCVE-2026-66914/docker-compose.control.yml:2
Run the seed script inside the web container to install Joomla and SEBLOD: docker compose -p cve-2026-66914-control -f docker-compose.control.yml exec web bash /usr/local/bin/lab-seed.shCVE-2026-66914/docker-compose.control.yml:3
Run the PoC against the control environment to verify the fix: python3 poc/poc.py http://127.0.0.1:8781CVE-2026-66914/README.md:100-101

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The control environment is a self-contained lab that only exposes a web service on a configurable host port. The PoC targets the lab's own web server to demonstrate the vulnerability fix; no behavior escapes the container boundary, persists beyond the lab, steals credentials, or destroys data outside the intended lab target.

CVE-2026-66914/docker-compose.control.yml:20-37CVE-2026-66914/poc/poc.py:1-104

Review boundaries

What the analysis did not establish

The packet includes only the control (patched) Compose file and Dockerfile; the vulnerable counterparts (docker-compose.yml, Dockerfile.vulnerable) are present in the file inventory but not included as evidence text.
The SEBLOD zip files are binary and uninspected.
The PoC script is present but its behavior is only described, not executed in this analysis.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-66914/docker-compose.yml

CVE-2026-66914Created 2026-05-19Vuln labCVE-2026-66914Compose · mixed

1 Compose manifest · 1 Dockerfile · 2 services

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Environment assessment

A Docker Compose environment for demonstrating CVE-2026-66914, an unauthenticated path traversal vulnerability in the SEBLOD Joomla extension. It consists of a MariaDB database service and a web service built from a custom Dockerfile that installs Joomla 4.4 and the vulnerable SEBLOD 3.29.0b package.

CVE-2026-66914/docker-compose.yml:1-42CVE-2026-66914/Dockerfile.vulnerable:1-21CVE-2026-66914/README.md:1-131

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Vulnerable environment' for CVE-2026-66914, provides a vulnerability summary, root cause analysis, and PoC usage instructions. The Dockerfile installs the vulnerable SEBLOD version and creates canary files for traversal evidence. The compose file orchestrates the vulnerable web and database services.

CVE-2026-66914/README.md:1-2CVE-2026-66914/README.md:5-18CVE-2026-66914/Dockerfile.vulnerable:1-21

Lab shapeCompose · mixed

Services2

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

db

database server

A MariaDB 10.11 container that stores Joomla data. It is configured with strict SQL mode disabled to accommodate SEBLOD 3.x seed SQL. It exposes no ports to the host and uses a named volume for persistence.

CVE-2026-66914/docker-compose.yml:4-19

web

vulnerable web application server

A custom-built container based on joomla:4.4-apache that includes the vulnerable SEBLOD 3.29.0b extension. It copies seed scripts and a web installer, creates canary files for traversal testing, and patches the Joomla DB driver to remove strict mode. It exposes port 80 mapped to host port 8780.

CVE-2026-66914/docker-compose.yml:21-37CVE-2026-66914/Dockerfile.vulnerable:1-21

seed.sh

lab initialization script

A shell script that runs inside the web container to install Joomla via CLI and then install the SEBLOD package via a web-based installer. It waits for Apache to be ready before proceeding.

CVE-2026-66914/seed.sh:1-46

web-install.php

SEBLOD web-based installer

A PHP script that performs a web-based installation of the SEBLOD package because its postflight requires a web application context. It logs into the Joomla administrator, extracts the package, and installs the library and component in the correct order.

CVE-2026-66914/web-install.php:1-113

poc.py

proof-of-concept exploit

A Python script that demonstrates the CVE-2026-66914 path traversal by requesting /etc/passwd through the vulnerable download task. It verifies the response content and reports success or failure.

CVE-2026-66914/poc/poc.py:1-104

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-66914

Supported by supplied evidence

The README, PoC script, and verification report all describe and demonstrate an unauthenticated path traversal in SEBLOD's download task. The Dockerfile installs the vulnerable version 3.29.0b, and the PoC targets the exact vulnerable endpoint. The verification report confirms successful exploitation against the lab's vulnerable build and failure against a patched control.

CVE-2026-66914/README.md:5-18CVE-2026-66914/poc/poc.py:1-104CVE-2026-66914/poc_verification_report.md:1-17

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker Engine with Compose pluginCVE-2026-66914/README.md:82-83
Network access to Docker Hub for base imagesCVE-2026-66914/README.md:84
The SEBLOD package zip (pkg_seblod_3.29.0b.zip) must be present in the assets/ directoryCVE-2026-66914/Dockerfile.vulnerable:4

Evidence-described exercise path

Build and start the vulnerable environment: docker compose up -d --buildCVE-2026-66914/README.md:95
Seed the lab: docker compose exec web bash /usr/local/bin/lab-seed.shCVE-2026-66914/README.md:96
Run the PoC against the vulnerable build: python3 poc/poc.py http://127.0.0.1:8780CVE-2026-66914/README.md:103
Optionally run the PoC against a patched control build to observe the fix.CVE-2026-66914/README.md:104

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target. The PoC reads /etc/passwd from within the vulnerable container and does not attempt to escape the container, access the host, or connect to external systems. The delete-after-read side effect is documented and demonstrated only on lab-owned canary files inside the container. No hidden, destructive, or backdoor behavior is present.

CVE-2026-66914/poc/poc.py:1-104CVE-2026-66914/poc_verification_report.md:1-17CVE-2026-66914/Dockerfile.vulnerable:10-14

Review boundaries

What the analysis did not establish

The packet does not include the contents of the SEBLOD zip files (pkg_seblod_3.29.0b.zip and pkg_seblod_3.30.0.zip), which are binary and uninspected.
The control environment (docker-compose.control.yml and Dockerfile.patched) is referenced but not included in the evidence files, so the patched build cannot be fully assessed.
The PoC script is not executed; only its source code is analyzed.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-66914

seblod.comproduct

https://www.seblod.com/