Skip to content
OpenAdvisories
Critical · 9.2 CVE-2025-54473 EUVD-2025-25021GHSA-gwjg-r9g6-4q23

Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla

Published Aug 15, 2025 · Updated Aug 15, 2025 · Assigned by Joomla

Vendor: phoca.cz Product: phoca.cz - Phoca Commander for Joomla Category: Web / CMS

Description

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature.

Affected products

VendorProductAffectedFixed
phoca.cz phoca.cz - Phoca Commander for Joomla 5.0.0-5.0.1, 1.0.0-4.0.0 —

References