Alex Joseph
A significant security flaw has been discovered in the Event Gallery extension for Joomla!, allowing for critical data manipulation. This vulnerability, identified as CVE-2026-97164, could enable an authenticated attacker to delete files and folders on your web server.
The issue stems from a component within the “clear cache” task of the Event Gallery extension. If exploited, an attacker could use a specific parameter to recursively wipe out any directories that the web server has permission to write to. This could lead to a severe loss of data and impact the functionality of your Joomla! website.
CVE Details
Product: Joomla Extension – Event Gallery by svenbluege.de
Published Date: September 27, 2026
Severity: High
Status: Analyzed
Affected Products
The vulnerability impacts the Event Gallery extension for Joomla!, specifically any versions older than 6.5.0. If you are running an earlier version of this popular gallery component, your system is at risk.
Current Status
This vulnerability has been officially analyzed. This means the details of the flaw are understood and have been documented, allowing developers and administrators to take informed action.
Severity Level
Rated as HIGH severity with a CVSS score of 8.1, this vulnerability poses a serious threat. A high severity rating indicates that exploiting this flaw could lead to significant damage, such as widespread data loss, website defacement, or disruption of services. Since an attacker needs to be authenticated, the impact is slightly mitigated, but the potential for recursive directory deletion makes it a critical concern for affected users.
Possible Solutions
To protect your Joomla! website from this authenticated arbitrary path deletion vulnerability, it is crucial to update your Event Gallery extension immediately. The developer, svenbluege.de, has released updated versions that address this issue.
- Upgrade your Event Gallery extension to version 6.5.0 or later.
- As of our research, version 6.6.0 is available for download on the developer’s website.
- Keep an eye out for the upcoming Event Gallery 7.0, which promises further enhancements and security updates.
Always ensure you back up your website before performing any updates to prevent data loss during the process.
References
https://www.svenbluege.de/
https://nvd.nist.gov/vuln/detail/CVE-2026-97164
