[20260905] - Core - Arbitrary directory deletion via cache purge action

Project: Joomla!
SubProject: CMS
Impact: High
Severity: High
Probability: Low
Versions: 4.0.0-5.4.8,6.0.0-6.1.3
Exploit type: Path Traversal
Reported Date: 2026-08-13
Fixed Date: 2026-09-25
CVE Number: CVE-2026-90915

Description

An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3

Solution

Upgrade to version 5.4.9, 6.1.4

Contact

The JSST at the Joomla! Security Centre.

Reported By: Aria Akhavan, Calif.io in collaboration with Anthropic