The vulnerability arises from an improper validation of the layout parameter in Joomla!’s HTMLView. Attackers can supply arbitrary file paths, causing the application to include local files on the server. This local file inclusion can lead to reading sensitive files such as configuration files, database credentials, or execution of malicious code if the included file is interpreted. The weakness is classified as CWE‑22.

The issue affects the Joomla! CMS supplied by the Joomla! Project. No specific product version is listed in the advisory, so the vulnerability may apply broadly to installations that have not applied the referenced patch. Administrators should check whether their Joomla! CMS version is older than the fix referenced by the security announcement.

The CVSS base score is 7.5, indicating a high severity for local required attack privilege. The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a web request that manipulates the layout parameter. Exploitation requires the attacker to have enough permissions to read files via the web server, so it is typically limited to local or privileged accounts. However, the impact remains significant if sensitive files can be accessed.