Summary
Cache purge accepts traversal segments in cache-group names and checks containment before resolving them, enabling deletion outside the cache directory.
Affected Products
Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3 per the vendor advisory. Original report tested Joomla 6.1.2. Fixed in 5.4.9 / 6.1.4.
Affected Scope
- Product
- Joomla
- Component
- com_cache purge and file-cache storage
- Affected function
- administrator/components/com_cache/src/Controller/DisplayController.php; administrator/components/com_cache/src/Model/CacheModel.php; libraries/src/Cache/Storage/FileStorage.php — clean / _deleteFolder / _cleanPath
- Affected versions
- Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3
- CWE
- CWE-22, CWE-73
Technical Summary
Cache purge accepts traversal segments in cache-group names and checks containment before resolving them, enabling deletion outside the cache directory.
Prerequisites and Permissions
Authenticated backend access with core.manage on com_cache and a valid CSRF token. Default Administrator/Super User access; not Manager by default.
Affected Locations
administrator/components/com_cache/src/Controller/DisplayController.php; administrator/components/com_cache/src/Model/CacheModel.php; libraries/src/Cache/Storage/FileStorage.php — clean / _deleteFolder / _cleanPath
Reproducible Proof
Only in a disposable lab, create a dedicated harmless sentinel directory outside the cache root, owned by the test environment. Compare a normal cache-group purge with a traversal group that resolves to that sentinel. Confirm the sentinel’s removal and that no unrelated paths were touched. Never point the test at real site or shared-host directories.
Vulnerable Code
$cid = (array) $this->input->post->get(&class="tok-comment">#39;cidclass="tok-string">', [], 'string');
class="tok-comment">// ... CacheModel forwards group to FileStorage.
$path = $this->_cleanPath($path);
$pos = strpos($path, $this->_cleanPath($this->_root));
class="tok-comment">// Source report: parent segments are not resolved before this containment check.Severity
high
CVSS
8.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Technical Analysis
The purge controller accepts cid[] cache-group strings and forwards them through CacheModel to FileStorage. FileStorage builds a path beneath the cache root and applies a literal prefix check after slash cleanup, without resolving parent-directory segments. The filesystem resolves those segments later, so a path that passes the textual check can refer to an unrelated writable directory. Recursive deletion then operates outside the cache root.
A valid administrative session, com_cache management permission and a CSRF token are required. The original report found Manager and front-end roles denied by default; Administrator and Super User could reach the action. The deletion boundary is the web-server account’s filesystem permissions.
Original Joomla finding 06. Vendor-confirmed and fixed; see the coordination notes and linked official advisory.
Impact
Integrity and availability: an authorized cache-management user can delete directory trees writable by the web-server account beyond the cache root, potentially outside the Joomla installation. No direct confidentiality impact established.
Remediation
Upgrade to Joomla 6.1.4 / 5.4.9 or a later supported release. Reject invalid cache-group names and enforce canonical filesystem containment before recursive deletion. Upgrade rather than relying only on filesystem permissions.
Vendor advisory: https://developer.joomla.org/security-centre/1085-20260905-core-arbitrary-directory-deletion-via-cache-purge-action.html
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan. The vendor’s combined advisory also credits Calif.io in collaboration with Anthropic.