CVE-2026-117542: Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8
Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated updatefile form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jDownloadsto a version that resolves this vulnerability.Fixed in 4.1.8
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue requires authentication. An attacker must be able to submit a manipulated update_file form parameter.
What is the impact of a successful exploit?
An attacker could move files from outside the permitted selection directory or assign them to a download. This may expose file contents and remove source files from their original locations.
Which versions are affected?
jDownloads versions earlier than 4.1.8 are affected.