An improper validation of the cache group name in Joomla enables path traversal that allows an attacker to delete arbitrary directories from the file system where Joomla is installed. The vulnerability is a classic input validation flaw (CWE-22) that can compromise the integrity of site assets and may lead to loss of important data or website downtime.

The Joomla! CMS, supplied by the Joomla! Project, is affected across versions 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3. All installations that have not applied the pending update are vulnerable.

The CVSS score of 7 denotes a high severity, and while the EPSS data is not available, the fact that the flaw involves directory deletion without additional checks indicates a serious risk to data integrity. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish its potential impact. The likely attack vector is an authenticated administrator executing a cache purge with a crafted cache group name; the attack requires access to the Joomla administrative interface but could be leveraged remotely if those privileges are compromised or weakly protected.