toanln-cov/cve-2026-66493The Joomla extension PhocaCommander is vulnerable to Path Traversal in delete, copy, move actions - CVSS 6.4
PhocaCommander ≤ 6.1.3 — Authenticated Admin Manipulates Files Outside Webroot
The file action handler in PhocaCommander constructs source and destination paths from attacker-controlled base64-encoded parameters (pathfrom, pathwhere) without any path containment validation. An authenticated administrator can delete, copy, and move files anywhere on the filesystem accessible to the web server process.
Confirmed in the lab: deleting a file at /tmp/ (outside the webroot) and copying into the PhocaCommander file manager — making its content readable via the built-in editor. All three operations (delete, copy, move) share the same unvalidated code path.
/etc/passwd| COMPONENT | VULNERABLE | TESTED ON | FIXED |
|---|---|---|---|
| PhocaCommander | 1.0.0 – 6.1.3 | Joomla 5.4.7 + PhocaCommander 6.1.3 (PHP 8.2 / Apache) | 6.1.4 |
Authentication required: Administrator (session + CSRF token)
File: administrator/components/com_phocacommander/views/phocacommanderactiona/view.json.php
The action view decodes pathfrom and pathwhere from base64 and concatenates them directly onto JPATH_ROOT with no containment check. These unvalidated paths are then used in all three file operations:
VIEW.JSON.PHP — VULNERABLE PATH CONSTRUCTION
// Both parameters decoded from base64 — no containment check
$pathFrom = JPATH_ROOT . '/' . base64_decode($this->t['pathfrom']) . '/';
$pathWhere = JPATH_ROOT . '/' . base64_decode($this->t['pathwhere']) . '/';
// Delete — removes any file reachable by www-data
$srcValue = $pathFrom . $v;
if (PhocaCommanderHelper::fileExists($srcValue)) {
File::delete($srcValue);
}
// Copy / Move — arbitrary cross-directory file operations
File::copy($pathFrom . $v, $pathWhere . $v);
File::move($pathFrom . $v, $pathWhere . $v);
PhocaCommanderHelper::fileExists() uses is_file(Path::clean($file)). Path::clean() normalizes slashes but does not strip ../ sequences, so traversal sequences in either parameter resolve to arbitrary filesystem paths unchecked.
A test file is created at /tmp/poc.txt owned by www-data, confirming the target exists before the delete operation.
Authenticate via the admin login page. Retrieve the Joomla form token — it appears as a hidden input field on any admin page.
Parameters decoded:
pathfrom=Li4vLi4vLi4vdG1w → ../../..tmp → /tmp/selfiles[0]=file|cG9jLnR4dA== → filename poc.txtREQUEST / RESPONSE
Reuse the admin session from Scenario 1 or authenticate again to obtain a fresh CSRF token.
Parameters decoded:
pathfrom=Li4vLi4vLi4vLi4vZXRj → ../../../../etc → /etc/pathwhere=cGhvY2EtZmlsZXM= → phoca-files → /var/www/html/phoca-files/selfiles[0]=file|cGFzc3dk → filename passwdREQUEST / RESPONSE
/etc/passwd is now present inside the webroot at phoca-files/passwd, owned by www-data.
Navigate to the PhocaCommander file manager in the admin panel, open phoca-files/, and click to file passwd then click Edit to view its contents in the built-in CodeMirror editor. The full /etc/passwd content is rendered:
www-data outside the webroot can be permanently removed, including application configs, lock files, and cron jobs of other services/etc/shadow, private keys, other apps' .env files) into the webroot makes them reachable via HTTP without any further action