Unscored CVE-2020-35612 EUVD-2020-23278GHSA-jh7g-mcqh-6w6x

[20201103] - Core - Path traversal in mod_random_image

Published Dec 28, 2020 · Updated Feb 24, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validation, leading to a path traversal vulnerability.

Affected products

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	2.5.0-3.9.22	—

References

https://developer.joomla.org/security-centre/830-20201103-core-path-traversal-in-mod-random-image.html vendor-advisory