A significant security flaw has been discovered in the Event Gallery extension for Joomla!, allowing for critical data manipulation. This vulnerability, identified as CVE-2026-97164, could enable an authenticated attacker to delete files and folders on your web server.<\/p>\n
The issue stems from a component within the “clear cache” task of the Event Gallery extension. If exploited, an attacker could use a specific parameter to recursively wipe out any directories that the web server has permission to write to. This could lead to a severe loss of data and impact the functionality of your Joomla! website.<\/p>\n
Product:<\/strong> Joomla Extension – Event Gallery by svenbluege.de<\/p>\n Published Date:<\/strong> September 27, 2026<\/p>\n Severity:<\/strong> High<\/p>\n Status:<\/strong> Analyzed<\/p>\n The vulnerability impacts the Event Gallery extension for Joomla!, specifically any versions older than 6.5.0. If you are running an earlier version of this popular gallery component, your system is at risk.<\/p>\n This vulnerability has been officially analyzed. This means the details of the flaw are understood and have been documented, allowing developers and administrators to take informed action.<\/p>\n Rated as HIGH severity with a CVSS score of 8.1, this vulnerability poses a serious threat. A high severity rating indicates that exploiting this flaw could lead to significant damage, such as widespread data loss, website defacement, or disruption of services. Since an attacker needs to be authenticated, the impact is slightly mitigated, but the potential for recursive directory deletion makes it a critical concern for affected users.<\/p>\n To protect your Joomla! website from this authenticated arbitrary path deletion vulnerability, it is crucial to update your Event Gallery extension immediately. The developer, svenbluege.de, has released updated versions that address this issue.<\/p>\n Always ensure you back up your website before performing any updates to prevent data loss during the process.<\/p>\n https:\/\/www.svenbluege.de\/<\/p>\n https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-97164<\/p>\n","protected":false},"excerpt":{"rendered":" A significant security flaw has been discovered in the Event Gallery extension for Joomla!, allowing for critical data manipulation. This vulnerability, identified as CVE-2026-97164, could enable an authenticated<\/p>\n","protected":false},"author":17,"featured_media":2649,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1355,1354,980,971,695],"class_list":["post-4382","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-data-deletion","tag-event-gallery","tag-joomla","tag-path-traversal","tag-web-security"],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n