CVE-2011-2891: Joomla!

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

Joomla! 1.6.x before 1.6.2 allows remote attackers to obtain sensitive information via an empty Itemid array parameter to index.php, which reveals the installation path in an error message, a different vulnerability than CVE-2011-2488.

Affected products

• Joomla! Joomla!: version 1.6 only; version 1.6.0 only; version 1.6.1 only

Published 2011-07-27. Last modified 2026-06-16.