sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

High 7.0 Published Updated

Authenticated attackers can delete arbitrary directories via path traversal in the Event Gallery extension's cache clearing task.

Exploited in the wild
Not known
Login needed
An administrator
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2026-97164?

CVE-2026-97164 is a high-severity path traversal vulnerability in svenbluege.de Event Gallery for Joomla, published on 27 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `cache.process` task, you can recursively delete any directories that the web server is authorized to write to.

Weakness: CWE-22

Which versions are affected by CVE-2026-97164?

It affects 1 product.

Products include Svenbluege Event Gallery.

How do I fix CVE-2026-97164?

No fix has been published for CVE-2026-97164 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-97164 being exploited?

There is no known exploitation of CVE-2026-97164 in the wild and no public exploit code.

Sources

Also known as GHSA-v9wv-4x5c-j6q9.

Is CVE-2026-97164 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free