/Vulnerability Library

SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal

CVE-2026-66914
Verified

Description

Joomla Extension SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 contains an unauthenticated path traversal caused by improper validation of file paths, letting unauthenticated attackers download files inside and outside the webroot, exploit requires no authentication.

Severity

Critical

CVSS Score

9.2

Exploit Probability

2%

Affected Product

seblod

Published Date

September 21, 2026

Template Author

het kalariya

CVE-2026-66914.yaml
9.2Score

CVSS Metrics

CVSS Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CVE ID:
cve-2026-66914
CWE ID:
cwe-22

References

https://nvd.nist.gov/vuln/detail/CVE-2026-66914https://www.seblod.com/

Remediation Steps

Update to SEBLOD 3.30.0, 4.7.0, 6.0.1 or later.