CVE-2026-76611: CWE-22 Improper Limitation of a Pathname to a Restricted Directory in yootheme.com Zoo extension for Joomla

The vulnerability identified as CVE-2026-76611 affects the Zoo extension for Joomla by yootheme.com. Versions from 1.0.0 up to and including 4.1.65 are vulnerable to an unauthenticated arbitrary directory listing attack through the Gallery element. This is caused by improper limitation of a pathname to a restricted directory (CWE-22), allowing attackers to list directory contents without authentication. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on integrity but no impact on confidentiality or availability.

An unauthenticated attacker can list arbitrary directories on the affected Joomla site running the vulnerable Zoo extension, potentially exposing sensitive directory contents. There is no indication of direct confidentiality, integrity, or availability compromise beyond directory listing. No known exploits are reported in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected Gallery element or disabling it if feasible to reduce exposure.