Phoca Commander (com_phocacommander) below 6.1.2 - Authenticated Arbitrary File Write (RCE), Arbitrary File Read and Reflected XSS

Phoca Commander is a dual-pane file manager that runs in the Joomla administrator. Every version below 6.1.2 is affected by several backend flaws that let a logged-in user with access to the component do far more than the component is supposed to allow. (1) Arbitrary file write / RCE: the file editor's save() action wrote whatever filename it was given, with no extension deny-list, so a user with core.edit could write PHP straight into the web root; the rename action in the file list had the same hole (rename image.jpg to shell.php). (2) Arbitrary file read / disclosure: the download() action was gated only on the blanket core.manage permission and did no path-containment check, so a low-privileged backend user could read any file the web server could read, including configuration.php with the database credentials. Both paths also accepted ../ traversal outside the Joomla root, because Path::clean() normalises a path but does not reject one that escapes the root. (3) Reflected XSS: request-controlled ordering, direction, panel and folder values were concatenated unescaped into a JavaScript string that is emitted inside an HTML onclick attribute, and into hidden form inputs in the editor view. Also folded into this rule: CVE-2025-54473, the earlier authenticated RCE via the unzip feature affecting 1.0.0-4.0.0 and 5.0.0-5.0.1 (fixed in 4.0.1 / 5.0.2). Fixed in 6.1.2, released 24 July 2026 (the file write and file read fixes shipped in 6.1.1, the XSS fix in 6.1.2). Do not stop at 6.1.2: 6.1.2 and 6.1.3 are themselves affected by three further path traversal flaws (CVE-2026-66491, CVE-2026-66492, CVE-2026-66493), so the minimum safe version is 6.1.4, released 5 August 2026. Note that Joomla will never offer you this update by itself on a Joomla 3, 4 or 5 site: Phoca ships one update manifest whose 6.x entries are pinned to targetplatform 6, so a Joomla 5 site only ever sees the 5.1.0 entry (October 2025, which predates all of these fixes) and reports nothing to do. Install 6.1.4 by hand from https://github.com/PhocaCz/PhocaCommander/releases/download/6.1.4/com_phocacommander_v6.1.4.zip using System, Extensions under Install, then the Install from URL tab. The 6.x builds run fine on Joomla 5. If you cannot update immediately, uninstall or unpublish the component, and in the meantime restrict com_phocacommander access so only Super Users can reach it - none of this is reachable without a backend login, but any Manager or Administrator level account is enough. CVE assignment (Joomla CNA, 27 July 2026): CVE-2026-65764 covers the reflected XSS in 5.0.0-6.1.1 (CVSS 4.0 5.1 MEDIUM) and CVE-2026-65765 covers the path traversal in the save and download actions in 1.0.0-6.1.1 (CVSS 4.0 6.9 MEDIUM). Both are already flagged by this rule; no version-boundary change was needed.

Affected versions: < 6.1.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions