CVE-2009-4946: Directory traversal vulnerability in the Messaging (com_messaging) component before 1.5.1 for Joomla!

Security readout for executives and security teams

This CVE describes a Joomla Messaging component issue where a remote attacker could misuse a request parameter to make the application include and execute local files. That can become serious if the affected component is publicly reachable. The public record warns that provenance is unknown and details come only from third parties. Exposure is most likely on legacy Joomla sites running the Messaging com_messaging component before 1.5.1 and exposing index.php messaging actions publicly. The bundle does not provide CPEs, package names, or supported product inventory data. Prioritize discovery on internet-facing legacy Joomla assets. The potential impact is high because file inclusion can lead to code execution, but urgency is moderated by weak source provenance and no confirmed active exploitation in the provided evidence. Mitigation focus: Inventory Joomla instances and identify any com_messaging component installations.; If affected, update com_messaging to 1.5.1 or later per vendor guidance.; Restrict public access to obsolete Joomla administrative or messaging surfaces where possible..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.