A significant security flaw has been identified in the core of Joomla!, a widely-used content management system. This vulnerability, tracked as CVE-2026-90915, could allow an attacker to delete arbitrary directories on your website. Essentially, a weakness in how Joomla! handles cache group names opens the door for malicious actors to trick the system into deleting folders it shouldn’t, potentially causing major disruption to your site.<\/p>\n
This issue stems from insufficient checking of the cache group name, which can be manipulated to include “path traversal” sequences. These sequences allow an attacker to move beyond the intended cache directory and target other parts of your server’s file system for deletion. While the probability of this exploit occurring is considered low, the impact if successful is high, making it a serious concern for administrators.<\/p>\n
Product:<\/strong> Joomla! Core<\/p>\n Published:<\/strong> September 29, 2026<\/p>\n Severity:<\/strong> Medium<\/p>\n Status:<\/strong> Analyzed<\/p>\n This vulnerability impacts specific versions of the Joomla! CMS. You are at risk if your Joomla! installation falls within these ranges:<\/p>\n It is crucial to verify your current Joomla! version to determine if your site is affected.<\/p>\n The vulnerability has been thoroughly analyzed by the Joomla! Security Strike Team (JSST). They have acknowledged the issue and released patches to address it. The fix was officially released on September 25, 2026.<\/p>\n The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 6.5, classifying it as Medium severity<\/strong>. However, the Joomla! Security Strike Team has indicated a “High” impact and severity, highlighting the potential for significant damage if exploited. The primary concern is the potential for arbitrary directory deletions, which could lead to data loss or website defacement.<\/p>\n To protect your Joomla! website from this vulnerability, the most effective solution is to update your installation immediately. The Joomla! Project has released patched versions that resolve the improper validation of cache group names.<\/p>\n Always back up your website before performing any updates to ensure you can restore it if any issues arise during the upgrade process. Regular updates are a cornerstone of maintaining a secure web presence.<\/p>\n https:\/\/developer.joomla.org\/security-centre\/1085-20260905-core-arbitrary-directory-deletion-via-cache-purge-action.html<\/p>\n https:\/\/www.joomla.org\/<\/p>\n","protected":false},"excerpt":{"rendered":" Understanding the Joomla! Core Arbitrary Directory Deletion Vulnerability A significant security flaw has been identified in the core of Joomla!, a widely-used content management system. This vulnerability, tracked<\/p>\n","protected":false},"author":17,"featured_media":2649,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1293,1292,980,971,695],"class_list":["post-4155","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cache-purge","tag-directory-deletion","tag-joomla","tag-path-traversal","tag-web-security"],"yoast_head":"\nAffected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n