Is CVE-2026-73327 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73327?

CVE-2026-73327 has a CVSS v3 severity of HIGH (7.6).

Back

CVE-2026-73327

Description

Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be written outside the intended destination root and enabling persistent remote code execution via planted PHP files.