SEBLOD extension for Joomla - Path Traversal (CVE-2026-66914)

CVE-2026-66914 is a critical unauthenticated path traversal vulnerability in the SEBLOD extension for Joomla, affecting versions before 3.30.0, 4.7.0, and 6.0.1. Remote attackers can exploit the flaw to download files from within or outside the webroot, potentially exposing sensitive data and compromising the confidentiality of the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-66914 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2026-66914 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts target Joomla URLs containing /index.php?option=com_cck&task=download and use the file parameter with directory traversal sequences to request sensitive files such as /etc/passwd.