This vulnerability (CVE-2026-66914) in the SEBLOD extension for Joomla is an improper limitation of a pathname to a restricted directory (CWE-22), also known as a path traversal flaw. It allows unauthenticated attackers to access and download arbitrary files from the server, including those outside the intended webroot directory. The affected versions include all SEBLOD versions prior to 3.30.0, 4.7.0, and 6.0.1. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality and scope. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation allows an unauthenticated attacker to download arbitrary files from the server hosting the vulnerable SEBLOD Joomla extension. This can lead to disclosure of sensitive information, potentially including configuration files, credentials, or other critical data stored outside the webroot. The vulnerability does not require authentication or user interaction, increasing its risk. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict public access to sensitive files and directories on the server and consider applying web server-level access controls or WAF rules to block path traversal attempts. Monitor vendor channels for updates and apply patches promptly once available.