{"affected":[{"defaultStatus":"unaffected","product":"jDownloads extension for Joomla","source":"CNA: Joomla","vendor":"jdownloads.com","versions":[{"status":"affected","version":"1.0.0-4.1.7"}]}],"cveId":"CVE-2026-117542","cwes":["CWE-35"],"description":"Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or assign them to a download. This could expose file contents and remove source files from their original locations.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794506668377,"publishedAt":1794506668377,"references":[{"source":"CNA: Joomla","tags":["product"],"url":"https://www.jdownloads.com/"}],"remediation":[],"revision":"36f6eb4687d3afcae1f8c506a2adf2b16ae3792f8fc099b426a3c9968a571a5f","sources":[{"modifiedAt":1794506668377,"name":"CNA: Joomla","retrievedAt":1794510518003,"url":"https://www.cve.org/CVERecord?id=CVE-2026-117542"}],"ssvc":null,"status":"published","title":"Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8","updatedAt":1794510518003}