CVE-2026-73327 is a path traversal vulnerability in Joomla! CMS version 6.1.1 affecting the com_joomlaupdate extension. The vulnerability arises when a Super User extracts a crafted ZIP archive containing filenames with parent-directory segments or absolute paths. This causes the extraction routine (extract.php) to write files outside the intended destination root directory. Attackers can leverage this to plant malicious PHP files, resulting in persistent remote code execution. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, high complexity, and requiring high privileges and user interaction.

Successful exploitation allows an attacker to write files outside the intended directory, potentially planting malicious PHP files that enable persistent remote code execution on the Joomla server. This can lead to full compromise of the affected system if a Super User is induced to extract the crafted archive.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid extracting untrusted ZIP archives in the com_joomlaupdate extension and limit Super User interactions with untrusted content.