The vulnerability CVE-2026-66491 affects the Phoca Commander extension for Joomla, versions 1.0.0 to 6.1.3. It arises from improper restriction of pathname inputs in the getSource function, classified as CWE-22 (Path Traversal). This flaw allows an attacker with high privileges to read arbitrary files on the server by manipulating file path parameters. The CVSS 4.0 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No official remediation or patch has been published by the vendor at this time.

An attacker with high privileges can exploit this vulnerability to read arbitrary files on the server hosting the Joomla Phoca Commander extension. This can lead to disclosure of sensitive information, potentially compromising system confidentiality. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected extension and limit user privileges to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.