Skip to content
OpenAdvisories
Medium CVE-2021-26028 BIT-joomla-2021-26028EUVD-2021-0710GHSA-vgwr-773q-7j3c

[20210308] - Core - Path Traversal within joomla/archive zip class

Published Mar 4, 2021 · Updated Feb 25, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Package: joomla/archive Category: Web / CMS Ecosystem: Packagist

Description

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

Affected products

VendorProductAffectedFixed
Joomla! Project Joomla! CMS 3.0.0-3.9.24 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist joomla/archive < 1.1.10 1.1.10 GHSA-vgwr-773q-7j3c

References