CVE-2026-66493

A path traversal vulnerability exists in the Phoca Commander extension for Joomla, affecting versions 1.0.0 to 6.1.3, allowing unauthorized access to file system paths during delete, copy, and move operations. This could enable attackers to manipulate files outside of the intended directories, potentially leading to data exposure or system compromise. Joomla site administrators using this extension should prioritize patching or mitigating this vulnerability to safeguard their systems.