CVE-2026-40384

joomla: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2026-40384)

Affected

bitnami/joomla 4.0.0..*
bitnami/joomla 6.0.0..*

Description

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

Source: OSV (Open Source Vulnerabilities)cvelistv5 NVD (NIST)ENISA EUVD CVE.org (MITRE)BSI WID Portal BSI CSAF

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnamijoomla

4.0.06.0.0

Metrics

XIEM Effective CVSS

7.5

Source: nvd-v3

EPSS percentile

39.9 %

High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).

—

Show all metrics

Severity

high

69.34

Exploit maturity

no public PoC known

7.5

5.9

0.5 %

Low — model estimates < 1% exploitation likelihood.

Published

2026-05-29 08:44 UTC

CWE-22

Weakness classes (CWE)

CWE-22Base
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
cwe.mitre.org →

References & sources