Phoca Commander (com_phocacommander) below 6.1.2 - Authenticated Arbitrary File Write (RCE), Arbitrary File Read and Reflected XSS

Phoca Commander is a dual-pane file manager that runs in the Joomla administrator. Every version below 6.1.2 is affected by several backend flaws that let a logged-in user with access to the component do far more than the component is supposed to allow. (1) Arbitrary file write / RCE: the file editor's save() action wrote whatever filename it was given, with no extension deny-list, so a user with core.edit could write PHP straight into the web root; the rename action in the file list had the same hole (rename image.jpg to shell.php). (2) Arbitrary file read / disclosure: the download() action was gated only on the blanket core.manage permission and did no path-containment check, so a low-privileged backend user could read any file the web server could read, including configuration.php with the database credentials. Both paths also accepted ../ traversal outside the Joomla root, because Path::clean() normalises a path but does not reject one that escapes the root. (3) Reflected XSS: request-controlled ordering, direction, panel and folder values were concatenated unescaped into a JavaScript string that is emitted inside an HTML onclick attribute, and into hidden form inputs in the editor view. Also folded into this rule: CVE-2025-54473, the earlier authenticated RCE via the unzip feature affecting 1.0.0-4.0.0 and 5.0.0-5.0.1 (fixed in 4.0.1 / 5.0.2). Fixed in 6.1.2, released 24 July 2026 (the file write and file read fixes shipped in 6.1.1, the XSS fix in 6.1.2). Do not stop at 6.1.2: 6.1.2 and 6.1.3 are themselves affected by three further path traversal flaws (CVE-2026-66491, CVE-2026-66492, CVE-2026-66493), so the minimum safe version is 6.1.4, released 5 August 2026. Note that Joomla will never offer you this update by itself on a Joomla 3, 4 or 5 site: Phoca ships one update manifest whose 6.x entries are pinned to targetplatform 6, so a Joomla 5 site only ever sees the 5.1.0 entry (October 2025, which predates all of these fixes) and reports nothing to do. Install 6.1.4 by hand from https://github.com/PhocaCz/PhocaCommander/releases/download/6.1.4/com_phocacommander_v6.1.4.zip using System, Extensions under Install, then the Install from URL tab. The 6.x builds run fine on Joomla 5. If you cannot update immediately, uninstall or unpublish the component, and in the meantime restrict com_phocacommander access so only Super Users can reach it - none of this is reachable without a backend login, but any Manager or Administrator level account is enough. CVE assignment (Joomla CNA, 27 July 2026): CVE-2026-65764 covers the reflected XSS in 5.0.0-6.1.1 (CVSS 4.0 5.1 MEDIUM) and CVE-2026-65765 covers the path traversal in the save and download actions in 1.0.0-6.1.1 (CVSS 4.0 6.9 MEDIUM). Both are already flagged by this rule; no version-boundary change was needed.

How CVE-2025-54473 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

The rule below is rated High for the set of 3 CVEs it covers together, not for this record on its own.

Timeline

1. 15 August 2025CVE-2025-54473 record published by its CNA
2. 27 July 2026mySites.guru check added for Phoca Commander (before 6.1.2)

Rule details

Other vulnerabilities in Phoca Commander

Updating for CVE-2025-54473 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2025-54473 on cve.org (the official CVE record)
• CVE-2025-54473 in the NIST National Vulnerability Database
• phoca.cz/news/1488-phoca-commander-version-6-1-2-released-security-rel