CVE-2026-23898CWE-73

Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate

High · published April 1, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-04-01T09:03Z
EPSS history
Timeline
  • 01 APR 09:03Z
    Joomla! Core - [20260305] - Arbitrary file deletion in com_joomlaupdate
    cvelistv5