Alex Joseph
Understanding the Joomla! Core Arbitrary Directory Deletion Vulnerability
A significant security flaw has been identified in the core of Joomla!, a widely-used content management system. This vulnerability, tracked as CVE-2026-90915, could allow an attacker to delete arbitrary directories on your website. Essentially, a weakness in how Joomla! handles cache group names opens the door for malicious actors to trick the system into deleting folders it shouldn’t, potentially causing major disruption to your site.
This issue stems from insufficient checking of the cache group name, which can be manipulated to include “path traversal” sequences. These sequences allow an attacker to move beyond the intended cache directory and target other parts of your server’s file system for deletion. While the probability of this exploit occurring is considered low, the impact if successful is high, making it a serious concern for administrators.
CVE Details
Product: Joomla! Core
Published: September 29, 2026
Severity: Medium
Status: Analyzed
Affected Products
This vulnerability impacts specific versions of the Joomla! CMS. You are at risk if your Joomla! installation falls within these ranges:
- Joomla! CMS versions 4.0.0 through 5.4.8
- Joomla! CMS versions 6.0.0 through 6.1.3
It is crucial to verify your current Joomla! version to determine if your site is affected.
Current Status
The vulnerability has been thoroughly analyzed by the Joomla! Security Strike Team (JSST). They have acknowledged the issue and released patches to address it. The fix was officially released on September 25, 2026.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 6.5, classifying it as Medium severity. However, the Joomla! Security Strike Team has indicated a “High” impact and severity, highlighting the potential for significant damage if exploited. The primary concern is the potential for arbitrary directory deletions, which could lead to data loss or website defacement.
Possible Solutions
To protect your Joomla! website from this vulnerability, the most effective solution is to update your installation immediately. The Joomla! Project has released patched versions that resolve the improper validation of cache group names.
- If you are using a Joomla! 5.x series, you should upgrade to version 5.4.9.
- If you are using a Joomla! 6.x series, you should upgrade to version 6.1.4.
Always back up your website before performing any updates to ensure you can restore it if any issues arise during the upgrade process. Regular updates are a cornerstone of maintaining a secure web presence.
References
https://developer.joomla.org/security-centre/1085-20260905-core-arbitrary-directory-deletion-via-cache-purge-action.html
https://www.joomla.org/
