CVE-2026-66491 is a path traversal vulnerability (CWE-22) in the Phoca Commander extension for Joomla. It affects versions from 1.0.0 up to and including 6.1.3. The vulnerability arises from insufficient validation of file paths in the getSource function, enabling an attacker with high privileges to read arbitrary files on the server. The CVSS 4.0 base score is 8.2, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and security capabilities. There is no vendor advisory or patch information available at this time.

An attacker with high privileges can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information. The vulnerability does not require user interaction and has a high impact on confidentiality and security capabilities. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Phoca Commander extension to trusted administrators only and monitor for unusual file access patterns related to this component.