CVE-2026-65765 is a path traversal vulnerability (CWE-22) in the Phoca Commander extension for Joomla, affecting versions 1.0.0 to 6.1.1. The issue arises from insufficient validation or restriction of file paths used in save and download operations, which could allow an attacker with high privileges to access files outside intended directories. The vulnerability has been assigned a CVSS 4.0 base score of 6.9, indicating a medium level of severity. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

Successful exploitation could allow an attacker with high privileges to perform path traversal attacks, potentially accessing or manipulating files outside the intended directory scope. This could lead to unauthorized disclosure or modification of sensitive files within the Joomla environment. However, exploitation requires privileges and no remote user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Phoca Commander extension to trusted users only and monitor for unusual file access patterns. Avoid exposing the extension to untrusted users or the public internet.