CVE-2026-75115: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in yootheme.com YOOtheme Pro extension for Joomla

The YOOtheme Pro extension for Joomla (versions 2.3.0 to 5.0.40) contains a path traversal vulnerability (CWE-22) in its Filesystem source path filter. The filter relies on glob-based pattern matching which is insufficient to restrict file access properly. As a result, authenticated users with elevated privileges can exploit this flaw to read arbitrary files on the server, potentially exposing sensitive information. The CVSS 4.0 base score is 7.0, indicating a high severity vulnerability with network attack vector, low attack complexity, no user interaction, and partial impact on confidentiality, integrity, and availability.

An authenticated user with privileged access can read arbitrary files on the server hosting the YOOtheme Pro extension. This could lead to disclosure of sensitive information stored in files outside the intended directory scope. The vulnerability does not allow privilege escalation or remote code execution but compromises confidentiality and partially affects integrity and availability.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to privileged users and monitor for suspicious file access patterns related to the YOOtheme Pro extension.