This vulnerability in Joomla! CMS arises from improper limitation of a pathname to a restricted directory (CWE-22). Specifically, the cache purge action fails to properly validate the cache group name, allowing an attacker with high privileges to perform path traversal attacks that lead to arbitrary directory deletions. The affected versions are 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. The CVSS 4.0 score is 7.0, indicating high severity, with network attack vector, low attack complexity, no user interaction, and requiring high privileges.

An attacker with high privileges can exploit this vulnerability to delete arbitrary directories on the server within the caching layer's file storage. This can lead to denial of service or disruption of Joomla! CMS functionality by removing critical cached data or other files.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the cache purge functionality to trusted administrators only and monitor for suspicious activity related to cache management.