toanln-cov/cve-2026-66492The Joomla extension PhocaCommander is vulnerable to Path Traversal in the file upload action - CVSS 6.1
PhocaCommander ≤ 6.1.3 — Authenticated Admin Writes Files Outside Webroot
The file upload handler in PhocaCommander constructs the destination path from an attacker-controlled base64-encoded folder parameter without any path containment validation. An authenticated administrator can upload files to arbitrary locations outside the webroot that are writable by the web server process.
Confirmed in the lab: uploading with folder=Li4vLi4vLi4vdG1w (= ../../../tmp) places the uploaded file at — outside — owned by . In production PHP-FPM environments this can be chained to achieve remote code execution.
/tmp//var/www/html/www-data| COMPONENT | VULNERABLE | TESTED ON | FIXED |
|---|---|---|---|
| PhocaCommander | 1.0.0 – 6.1.3 | Joomla 5.4.7 + PhocaCommander 6.1.3 (PHP 8.2 / Apache) | 6.1.4 |
Authentication required: Administrator (session + CSRF token)
File: administrator/components/com_phocacommander/helpers/fileupload.php — realMultipleUpload()
realMultipleUpload() decodes the folder POST parameter from base64 and passes it directly into a Path::clean() concatenation, which is then used as the upload destination without any containment check.
FILEUPLOAD.PHP — VULNERABLE CODE
$folder = $app->getInput()->get('folder', '', '', 'string');
$folder = base64_decode($folder); // ← attacker-controlled
$path = JPATH_ROOT; // = /var/www/html
if (isset($folder) && $folder != '') {
$pathFolder = Path::clean($path . '/' . $folder . '/');
// e.g. Path::clean('/var/www/html/../../../tmp/')
// = '/tmp/' — outside the webroot, no error thrown
}
// ...
File::upload($file['tmp_name'], $pathFolder . strtolower($file['name']));
Path::clean() normalizes directory separators but does not resolve or strip ../ sequences. The resolved path is passed directly to File::upload() with no subsequent boundary check.
Upload Extension Allowlist
The handler enforces an extension allowlist (images, documents, archives, text files) and blocks server-executable types such as .php and .htaccess. However, many file types allowable by the whitelist — including shell scripts, cron job definitions, and configuration fragments — can cause significant harm when written to sensitive OS paths.
Authenticate via the admin login page. Retrieve the Joomla CSRF token from any admin page — it appears as a hidden form field or can be extracted from the page source.
Send a multipart POST request to POST /administrator/index.php?option=com_phocacommander&task=phocacommanderupload.multipleupload with the file content in the file field and the base64-encoded traversal path Li4vLi4vLi4vdG1w (= ../../../tmp) in the folder field. The server responds with HTTP 200 and {"jsonrpc":"2.0","result":"OK","code":200,"message":"Success: ","details":"Files uploaded"}.
REQUEST / RESPONSE
The file is confirmed at /tmp/upload_test.txt, owned by www-data, outside /var/www/html/.
www-data can receive attacker-chosen content, including paths used by the OS scheduler, SSH daemon, and other services.txt file containing PHP code combined with a .user.ini (auto_prepend_file) to a web-accessible directory triggers PHP execution on the next request to that directory