The vulnerability is a path traversal flaw in the Phoca Commander Joomla extension that allows the save and download actions to be directed outside the intended directory. By manipulating the path parameters, an attacker can read files located anywhere on the server that the PHP process can access and may also write to files if permissions allow. This can lead to disclosure of sensitive configuration files, source code, or the ability to plant malicious content, thus undermining the integrity and confidentiality of the web application and potentially enabling further exploitation.

Phoca Commander extension for Joomla, versions 1.0.0 through 6.1.1. Any Joomla installation that has enabled the save or download features of this extension is potentially impacted.

The CVSS score of 6.9 indicates a medium‑high severity and the EPSS score of < 1% suggests a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote (web request) because the flaw is triggered by manipulating parameters sent to the extension’s endpoints. An attacker does not need local access or administrative privileges to exploit the issue; sending crafted requests to the affected endpoints is sufficient to retrieve or overwrite files within the file system permissions of the PHP process.