UpHeron
All vulnerabilities

Servers and applications

CVE-2026-90915

Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions.

Severity
High 7.0
Published
29 Sept 2026
Last changed
6 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
5.4.8, 6.1.3
Sources
NVD

Affected software

SoftwareAffected versions
Joomla!Servers and applications · cpe:a:joomla:joomla\!
  • From 4.0.0 before 5.4.8
  • From 6.0.0 before 6.1.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-90915
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-90915