CVE-2026-90915
Joomla\!: path traversal
- Risk score
- 44/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions.
- Affected
- Joomla\!
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Joomla\!: Yellow, plan it in. Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.
The flaws
- CVE-2026-90915: Path traversal (CVSS 6.5 · EPSS 0%)
- CVE-2026-92227: Authentication bypass (CVSS 7.5 · EPSS 0%)
- CVE-2026-90906: Cross-site scripting (CVSS 8.3 · EPSS 0%)
- CVE-2026-92222: Server-side request forgery (CVSS 8.0 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Joomla\!
Where it stands
- No known exploitation
Connects to
- Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days
- Same product: Earlier Joomla\! warnings. 12 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions.
Last activity 29 Sep 2026. Patch Forecast updates every hour.