An improper limitation of paths for delete, copy, and move actions in the Phoca Commander extension for Joomla allows an attacker to perform path traversal. By specifying crafted file paths, a user can delete or manipulate files outside the intended directory. This can lead to accidental data loss, configuration compromise, or removal of critical files, thereby affecting the integrity and availability of the web application.

The vulnerability affects the Phoca Commander extension for Joomla, distributed by phoca.cz, versions 1.0.0 through 6.1.3.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, so the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to access the extension’s delete, copy, or move functionality—typically through a web request to the Joomla site—and can traverse upward in the file system to target arbitrary files. This path traversal is a classic CWE-22 weakness and can be exploited remotely if the affected extension is reachable and the user has the necessary permissions.