Phoca Commander (com_phocacommander) 6.1.2 to 6.1.3 - Authenticated Path Traversal: Arbitrary File Read, Upload, Delete, Copy and Move

Phoca Commander 6.1.2 and 6.1.3 are affected by three path traversal vulnerabilities that the 6.1.2 release did not close. CVE-2026-66491 (CVSS 8.2 High): the getSource function fails to limit paths, allowing any file on the server to be read, including configuration.php and its database credentials. CVE-2026-66492 (CVSS 6.1 Medium): the file upload action does not limit the destination path, so files can be written outside the intended directory. CVE-2026-66493 (CVSS 6.4 Medium): the delete, copy and move actions do not limit paths, so files anywhere on the server can be destroyed or relocated. All three require an authenticated backend user with access to the Phoca Commander file manager (high privileges), but the impact reaches outside the component and outside the site root. Update to 6.1.4 or later, which Phoca released on 5 August 2026 as an explicit security release fixing all three. Note that Joomla will never offer you this update by itself on a Joomla 3, 4 or 5 site: Phoca ships one update manifest whose 6.x entries are pinned to targetplatform 6, so a Joomla 5 site only ever sees the 5.1.0 entry (October 2025, which predates all of these fixes) and reports nothing to do. Install 6.1.4 by hand from https://github.com/PhocaCz/PhocaCommander/releases/download/6.1.4/com_phocacommander_v6.1.4.zip using System, Extensions under Install, then the Install from URL tab. The 6.x builds run fine on Joomla 5. If you cannot update immediately, unpublish or uninstall the Phoca Commander component and restrict backend access to trusted administrators only. Reported by Toan Le.

Affected versions: ≥ 6.1.2 and < 6.1.4

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

How CVE-2026-66493 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

Affected extensions and versions