CVE-2026-90915
[20260905] - Core - Arbitrary directory deletion via cache purge action
Published Sep 25, 2026 · Joomla Joomla
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 4.0.0-5.4.8,6.0.0-6.1.3 Exploit type: Path Traversal Reported Date: 2026-08-13 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90915 Description An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions. Affected Installs Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4.9, 6.1.4 Contact The JSST at the Joomla! Security Centre . Reported By: Aria Akhavan, Calif.io in collaboration with An
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2026 · Joomla Security
Detected
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 4.0.0-5.4.8,6.0.0-6.1.3 Exploit type: Path Traversal Reported Date: 2026-08-13 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90915 Description An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions. Affected Instal
Sources
- CVE.orgVulnerability recordCVE-2026-90915
Official CVE identifier
cve.org - Joomla SecurityVendor advisoryCVE-2026-90915
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 4.0.0-5.4.8,6.0.0-6.1.3 Exploit type: Path Traversal Reported Date: 2026-08-13 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90915 Description An improper validation of the cache group name allo
developer.joomla.org