The vulnerability identified as CVE-2026-23898 in Joomla! CMS arises from insufficient input validation in the autoupdate server mechanism, enabling an attacker with high privileges to delete arbitrary files on the system. This is classified under CWE-73 (Improper Neutralization of File Path Elements). The CVSS 4.0 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. The affected versions explicitly include all releases from 4.0.0 up to and including 5.4.3, and from 6.0.0 up to and including 6.0.3. There is no vendor advisory or patch link provided, and no cloud service is involved.

Successful exploitation allows an attacker with high privileges to delete arbitrary files via the autoupdate mechanism, which can cause destructive file deletion and potentially compromise system integrity and availability. The impact on confidentiality, integrity, and availability is rated high according to the CVSS vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the autoupdate mechanism to trusted administrators only and monitor for suspicious activity related to file deletions.