[20260905] - Core - Arbitrary directory deletion via cache purge action
Joomla fixed high-severity CVE-2026-90915, a cache-purge path traversal that can delete directories.
Joomla disclosed CVE-2026-90915, a path-traversal flaw in CMS cache handling. Improper validation of the cache group name allows traversal in the caching layer's file storage and can cause arbitrary directory deletion via the cache purge action. Affected versions are 4.0.0–5.4.8 and 6.0.0–6.1.3; upgrades to 5.4.9 or 6.1.4 fix it. Joomla rates impact and severity high but probability low, and does not report in-the-wild exploitation.
- Path traversal in cache-group name validation during cache purge.
- Flaw can delete arbitrary directories in the file cache storage.
- Affects Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3.
- Vendor rates impact and severity high, probability low; fixed in 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-90915
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla Security Strike Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90915 | Path traversal directory deletion in Joomla core | 7.0 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 4. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.