CVE-2026-90915

CVE-2026-90915 is a path-traversal flaw (CWE-22) in Joomla core’s file-based caching layer. Improper validation of the cache group name lets a traversal sequence be passed into cache file storage when the cache purge action runs, so arbitrary directories can be deleted. An attacker needs network access and high privileges (an administrator who can purge cache), with no user interaction; the result is high integrity and availability impact and no direct confidentiality loss. Every Joomla installation from 4.0.0 through 5.4.8 and from 6.0.0 through 6.1.3 is affected. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is none known.

What to do: Upgrade Joomla core to a vendor-patched release outside the affected ranges (later than 5.4.8 on the 4.x/5.x line and later than 6.1.3 on the 6.x line) as listed in the Joomla security advisory. Until then, restrict administrator and cache-purge privileges to trusted accounts, and if an admin account may have been misused, review logs and the filesystem for unexpected directory deletions.