CVE-2026-40383 is a local file inclusion vulnerability in Joomla! CMS caused by improper limitation of a pathname to a restricted directory (CWE-22). This occurs due to insufficient validation of user-supplied input, enabling an attacker with high privileges to include local files on the server. The affected versions are Joomla! CMS 3.2.1 to 5.4.5 and 6.0.0 to 6.1.0. The vulnerability has a CVSS 4.0 score of 7.5, reflecting network attack vector, low attack complexity, and required privileges. No patch or official remediation level has been disclosed by the Joomla! Project as of the publication date.

The vulnerability allows an attacker with high privileges to perform local file inclusion, potentially exposing sensitive files or executing unauthorized code on the affected Joomla! CMS server. This could lead to information disclosure or further compromise depending on the server configuration and files accessible. No known exploits in the wild have been reported, but the high CVSS score indicates a serious security risk if exploited.

Patch status is not yet confirmed — check the Joomla! Project advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity. Avoid exposing vulnerable Joomla! CMS versions to untrusted users. Apply updates promptly once the vendor releases a patch.