An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver.
Severity
CVSS 3.0
7.5 high
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)