CVE-2026-66491

The Phoca Commander extension for Joomla is vulnerable to arbitrary file read due to improper path restrictions in the getSource function, allowing attackers to access sensitive files on the server. This high-severity vulnerability could lead to data exposure and compromise the integrity of the affected systems. Joomla administrators and developers using this extension should prioritize immediate remediation to mitigate potential risks.