Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 Critical security update for YOOtheme We fixed 2 vulnerabilities: CVE-2026-75115: Arbitrary file read (contributor-level) CVE-2026-76613: SQL injection (contributor-level) Update YOOtheme immediately to 5.0.41 if untrusted users have permission to create articles.
Post summary
YOOtheme issued a critical update (v5.0.41) to fix CVE‑2026‑75115 and CVE‑2026‑76613; users are urged to update immediately.
CVE-2026-75115 Authenticated Arbitrary File Read in YOOtheme Pro 2.3.0-5.0.40 via Glob Pattern Attack https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-75115
Post summary
Announces CVE-2026-75115, an authenticated arbitrary file read vulnerability in YOOtheme Pro 2.3.0‑5.0.40, exploitable through a glob pattern attack.