This vulnerability (CVE-2026-40383) in Joomla! CMS arises from improper limitation of a pathname to a restricted directory (CWE-22). Specifically, user input is not properly validated, enabling local file inclusion. Affected versions include 3.2.1 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 base score is 7.5, reflecting network attack vector, low attack complexity, required privileges at high level, no user interaction, and high impacts on confidentiality, integrity, and availability. No vendor advisory or patch is currently provided, and the vulnerability is not related to a cloud service.

Successful exploitation could allow an attacker with high privileges to include local files on the Joomla! server, potentially leading to unauthorized information disclosure or modification of system files. The high CVSS score indicates significant impact on confidentiality, integrity, and availability. However, exploitation requires elevated privileges, limiting the attack surface to users with such access.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity related to file inclusion attempts. Avoid exposing administrative interfaces to untrusted networks.