CVE-2026-66493 is a CWE-22 path traversal vulnerability affecting the Phoca Commander extension for Joomla, versions 1.0.0 to 6.1.3. The vulnerability arises from insufficient validation of file paths used in delete, copy, and move actions, allowing attackers with high privileges to traverse directories outside intended boundaries. The CVSS 4.0 base score is 6.4 (medium severity), with network attack vector, low attack complexity, no user interaction, and requiring high privileges. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Exploitation of this vulnerability could allow an attacker with high privileges to access or manipulate files outside of permitted directories via path traversal. This could lead to unauthorized file deletion, copying, or moving, potentially impacting system integrity or confidentiality depending on the files accessed. However, the requirement for high privileges limits the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Phoca Commander extension to trusted users only and monitor for suspicious activity related to file operations. Avoid granting unnecessary high privileges to users of this extension.