CVE-2026-117542 · Other
NO FIX YET · SEE WHAT TO DO
jDownloads, a Joomla extension for file downloads, is affected by a path traversal flaw in the update_file parameter. A logged-in user can read file contents outside the permitted directory and move source files from their original locations.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the jDownloads Joomla extension below version 4.1.8. The attacker needs an authenticated account on the site, so sites with no user accounts that can log in are lower risk. Sites without jDownloads installed are not affected.
Not affected if jdownloads-4.1.8-or-later, jdownloads-not-installed
Who cares jdownloads, joomla, self-hosted
4.1.8 are affected; move to 4.1.8 or later.Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated update_file form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.