PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40384 Joomla! Project CVE debrief

A path traversal vulnerability exists in the com_media files API endpoint due to improper validation of the search parameter. The vulnerability allows an attacker with high privileges to read arbitrary files on the system. The issue is rated MEDIUM severity with a CVSS score of 5.9. The vulnerability was disclosed by the Joomla! Security Strike Team and affects Joomla! CMS core. The weakness is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Vendor
Joomla! Project
Product
Joomla! CMS
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-28
Advisory published
2026-05-26
Advisory updated
2026-05-28

Who should care

Organizations running Joomla! CMS with the com_media webservice endpoint enabled, particularly those exposing media management APIs to administrative users. Security teams should prioritize patching and access control review for affected installations.

Technical summary

The com_media component in Joomla! CMS provides a files API endpoint that accepts a search parameter. Insufficient validation of this parameter allows directory traversal sequences to bypass intended access restrictions. An attacker with high privileges can exploit this to read arbitrary files from the underlying file system. The vulnerability is present in the webservice endpoint implementation and does not require user interaction. The confidentiality impact is rated high while integrity and availability impacts are none.

Defensive priority

medium

Recommended defensive actions

  • Apply security updates from Joomla! when available per the vendor security advisory
  • Review and restrict access to the com_media API endpoint to authorized administrative users only
  • Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in API requests
  • Monitor access logs for suspicious search parameter values containing directory traversal sequences
  • Validate that file access controls prevent unauthorized file system traversal regardless of API input validation

Evidence notes

The vulnerability was disclosed by [email protected] and published in the Joomla! Security Centre. The NVD entry shows vulnStatus as 'Undergoing Analysis'. The CVSS 4.0 vector indicates network attack vector with low attack complexity, privileged required (PR:H), and high confidentiality impact (VC:H).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40384 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40384

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40384 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40384

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://developer.joomla.org/security-centre/1042-20260510-core-path-traversal-in-com-media-webservice-endpoint.html

    [email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.