An unauthenticated attacker can manipulate file paths in requests to download any file located inside or outside the Joomla webroot. This flaw permits the disclosure of private configuration files, application code, or sensitive data such as database credentials, leading to a significant confidentiality breach. The weakness is a classic path traversal issue (CWE-22).

The vulnerability exists in the SEBLOD extension supplied by seblod.com for Joomla. Versions prior to 3.30.0, prior to 4.7.0, and prior to 6.0.1 are affected. No other components are listed as impacted.

The CVSS score of 9.2 marks this flaw as critical, indicating a high likelihood of exploitation and maximum potential impact. Because the attack requires no authentication, an unauthenticated user can trigger the path traversal simply by sending crafted HTTP requests to the vulnerable extension. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, but the absence of these metrics does not diminish the inherent risk posed by the flaw. An attacker could obtain system files, configuration, or other sensitive documents, potentially serving as a foothold for further compromise.