---
id: CVE-2026-73327
title: >-
  Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate
  extension that allows a Super User to be induced into extracting a crafted
  archive containing directory traversal sequences or absolute paths in ZIP
  entry filen…
summary: >-
  Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate
  extension that allows a Super User to be induced into extracting a crafted
  archive containing directory traversal sequences or absolute paths in ZIP
  entry filen…
severity: high
cvss: 7.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H'
cwe:
  - CWE-22
published: '2026-08-12'
updated: '2026-08-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73327'
references:
  - url: 'https://github.com/joomla/joomla-cms'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/joomla/joomla-cms/commit/9678a171d37e1e10ca75c9124bdafe20fe14fa5b
    label: disclosure@vulncheck.com
  - url: 'https://github.com/joomla/joomla-cms/pull/48057'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/joomla-zip-slip-path-traversal-via-com-joomlaupdate-extract-php
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00853
epssPercentile: 0.55251
ingestedAt: '2026-08-15T21:29:26.999Z'
---

## Overview

Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be written outside the intended destination root and enabling persistent remote code execution via planted PHP files.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.