Path Traversal in Joomla Phoca Commander File Upload Action

Successful exploitation can allow an attacker to traverse outside the intended directory boundaries during file upload handling and access or write files in unauthorized locations. Depending on the permissions of the web server and Joomla deployment, this may enable unauthorized file manipulation, exposure of sensitive files, application compromise, or follow-on attacks through placement or overwrite of files in security-relevant locations.

Restrict access to the extension's file upload functionality to trusted administrators only, and disable the feature entirely if it is not operationally required. Apply filesystem permission hardening so the web server account cannot write to sensitive directories outside the intended upload path. Additional defensive measures include monitoring for anomalous file creation or modification and using web application controls to block traversal patterns in upload-related requests.

Upgrade Phoca Commander to a version newer than 6.1.3 when a vendor-fixed release is available. If no patched version is yet deployed, remove or disable the vulnerable extension where feasible. Review and harden the upload handling logic so that all user-supplied paths are normalized and constrained to an allowlisted base directory, and verify that traversal sequences cannot influence destination paths.