A lack of input validation in Joomla! CMS’s autoupdate server mechanism allows an attacker to delete arbitrary files on the server. The vulnerability can remove critical files, resulting in a loss of site integrity and potentially making the site unavailable. It is a file‑path traversal flaw classified as CWE‑73. The impact could include site downtime, loss of data, and facilitation of further compromise if essential configuration files are removed.

The vulnerability affects any installation of Joomla! CMS that uses the com_joomlaupdate component. No specific version numbers are listed in the advisory, but the issue applies to Joomla! CMS deployments that have the autoupdate feature enabled.

The CVSS base score of 8.6 indicates high severity. EPSS shows a low probability of exploitation (<1%), and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote web-based request to the autoupdate component, which an attacker can craft to specify arbitrary file paths. Although the probability of exploitation is currently low, the high impact necessitates timely action.