# CVE-2026-66914: SEBLOD extension for Joomla - Path Traversal

> Live exploitation tracking for CVE-2026-66914 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-66914

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.2
- **Public exploit available:** Yes
- **Affected products:** seblod.com SEBLOD extension for Joomla
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** cms

## Description

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot.

## CrowdSec analysis

[CVE-2026-66914](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-66914) is a critical unauthenticated path traversal vulnerability in the SEBLOD extension for Joomla, affecting versions before 3.30.0, 4.7.0, and 6.0.1. Remote attackers can exploit the flaw to download files from within or outside the webroot, potentially exposing sensitive data and compromising the confidentiality of the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.

CrowdSec network data shows that most actors exploiting CVE-2026-66914 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2026-66914 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts target Joomla URLs containing `/index.php?option=com_cck&task=download` and use the `file` parameter with directory traversal sequences to request sensitive files such as `/etc/passwd`.

## Timeline

- 2026-08-07: CVE Published. CVE-2026-66914 is published to NVD.
- 2026-10-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-66914 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-66914 for the first time.

## References

- https://www.seblod.com/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-66914.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-66914) follows observed exploitation activity for CVE-2026-66914. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.