The Event Gallery extension for Joomla contains a path traversal flaw in the clear cache task. By supplying a crafted images parameter to the cache.process routine, an authenticated user can recursively delete any directories that the web server is allowed to write to. The weakness is a classic file‑system traversal (CWE‑22) and results in loss of data and potential disruption of site functionality, affecting availability and integrity of the web application.

The vulnerability affects the Event Gallery extension provided by svenbluege.de for Joomla versions earlier than 6.5.0. No specific sub‑versions are listed, so all releases before 6.5.0 are potentially affected.

The CVSS score of 7 indicates a medium‑to‑high severity, with a significant impact if exploited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Joomla session and only affects directories writable by the web server, so an attacker would likely need an internal or compromised account. However, the ability to delete arbitrary directories can lead to denial of service or data loss, making the risk non‑negligible for sites that allow users significant write permissions.