CVE-2026-66493 is a path traversal vulnerability (CWE-22) in the Phoca Commander extension for Joomla, affecting versions 1.0.0 through 6.1.3. The vulnerability arises due to improper limitation of pathname inputs used in delete, copy, and move operations, which may allow an attacker with high privileges to traverse directories outside the intended restricted paths. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high scope and impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with high privileges to access or manipulate files outside the intended directories, potentially leading to unauthorized file deletion, copying, or moving. This could compromise system integrity and availability. However, exploitation requires high privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Phoca Commander extension to trusted users only and monitor for suspicious activity related to file operations within the extension.