This vulnerability (CVE-2026-40384) in Joomla! CMS is caused by improper limitation of a pathname to a restricted directory (CWE-22) due to insufficient validation of the search parameter in the com_media files API endpoint. This flaw could allow an attacker with high privileges to perform a path traversal attack, potentially accessing files outside the intended directory scope. The affected versions include Joomla! CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack traceability, and high vulnerability confidence.

The vulnerability allows an attacker with high privileges to perform path traversal via the com_media files API endpoint, potentially accessing or manipulating files outside the intended directory. This could lead to unauthorized information disclosure or modification within the Joomla! CMS environment. However, exploitation requires high privileges, and there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the com_media API endpoint to trusted users only and monitor for unusual activity related to file access. Avoid exposing administrative interfaces publicly.