{"id":"CVE-2026-117542","kind":"vulnerability","aliases":["CVE-2026-117542"],"related":[],"title":"Joomla jDownloads: authenticated path traversal lets files be moved or read","description":"Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations.","summary":"jDownloads, a Joomla extension for file downloads, is affected by a path traversal flaw in the update_file parameter. A logged-in user can read file contents outside the permitted directory and move source files from their original locations.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jdownloads","joomla","other","self-hosted"],"not_affected_if":["jdownloads-4.1.8-or-later","jdownloads-not-installed"],"how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager or the extension's manifest file.\n- Confirm whether the site uses the jDownloads extension at all.","fix":"- jDownloads versions before `4.1.8` are affected; move to `4.1.8` or later.","status":"open","published_at":"2026-11-12T19:16:47+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","triaged_at":"2026-11-12T19:41:00+00:00","updated_at":"2026-11-12T19:41:00+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T19:41:00Z","model":"claude-haiku-5-5","output":{"fix":"- jDownloads versions before `4.1.8` are affected; move to `4.1.8` or later.","reach":"internet","title":"Joomla jDownloads: authenticated path traversal lets files be moved or read","impact":"medium","summary":"jDownloads, a Joomla extension for file downloads, is affected by a path traversal flaw in the update_file parameter. A logged-in user can read file contents outside the permitted directory and move source files from their original locations.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","jdownloads","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or moves files outside the permitted directory","analyst_note":"unknown","how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager or the extension's manifest file.\n- Confirm whether the site uses the jDownloads extension at all.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["jdownloads-not-installed","jdownloads-4.1.8-or-later"],"who_is_affected":"Sites running the jDownloads Joomla extension below version 4.1.8. The attacker needs an authenticated account on the site, so sites with no user accounts that can log in are lower risk. Sites without jDownloads installed are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4577,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117542':14A,17A '-2026':13A,16A '4.1.8':72C 'affect':32B 'assign':98C 'authent':3A,67C 'bypass':80C 'content':51B,107C 'could':79C,104C 'cve':12A,15A 'directori':55B,96C 'download':30B,102C 'expos':105C 'extens':27B,65C 'file':7A,29B,41B,50B,59B,76C,85C,90C,106C,111C 'flaw':37B 'form':77C 'host':23B 'intend':82C 'jdownload':2A,18B,24B,71C 'jdownloads.com':66C 'joomla':1A,19B,26B,64C 'let':6A 'locat':63B,115C 'log':45B 'logged-in':44B 'manipul':74C 'move':9A,57B,89C 'origin':62B,114C 'outsid':52B,92C 'paramet':42B,78C 'path':4A,35B,68C 'permit':54B,94C 'read':11A,49B 'remov':109C 'restrict':87C 'select':86C,95C 'self':22B 'self-host':21B 'server':84C 'server-fil':83C 'sourc':58B,110C 'travers':5A,36B,69C 'updat':40B,75C 'user':47B","nicknames":[],"mitigations":[],"who_affected":"Sites running the jDownloads Joomla extension below version 4.1.8. The attacker needs an authenticated account on the site, so sites with no user accounts that can log in are lower risk. Sites without jDownloads installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jdownloads","joomla","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-117542':14A,17A '-2026':13A,16A 'authent':3A 'cve':12A,15A 'file':7A 'jdownload':2A 'joomla':1A 'let':6A 'move':9A 'path':4A 'read':11A 'travers':5A","search_b":"'affect':32B 'content':51B 'directori':55B 'download':30B 'extens':27B 'file':29B,41B,50B,59B 'flaw':37B 'host':23B 'jdownload':18B,24B 'joomla':19B,26B 'locat':63B 'log':45B 'logged-in':44B 'move':57B 'origin':62B 'outsid':52B 'paramet':42B 'path':35B 'permit':54B 'read':49B 'self':22B 'self-host':21B 'sourc':58B 'travers':36B 'updat':40B 'user':47B","search_c":"'4.1.8':72C 'assign':98C 'authent':67C 'bypass':80C 'content':107C 'could':79C,104C 'directori':96C 'download':102C 'expos':105C 'extens':65C 'file':76C,85C,90C,106C,111C 'form':77C 'intend':82C 'jdownload':71C 'jdownloads.com':66C 'joomla':64C 'locat':115C 'manipul':74C 'move':89C 'origin':114C 'outsid':92C 'paramet':78C 'path':68C 'permit':94C 'remov':109C 'restrict':87C 'select':86C,95C 'server':84C 'server-fil':83C 'sourc':110C 'travers':69C 'updat':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:16:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117542","severity":null,"published_at":"2026-11-12T19:16:47+00:00","modified_at":"2026-11-12T19:16:47+00:00","first_seen_at":"2026-11-12T19:40:13+00:00","fetched_at":"2026-11-12T19:40:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}