CVE-2025-54473: Phoca.cz - Phoca Commander For Joomla

Critical severity, CVSS 9.2. EPSS: 0.4% chance of exploitation in the next 30 days.

An authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla was discovered. The issue allows code execution via the unzip feature.

Affected products

• Phoca.cz Phoca.cz - Phoca Commander For Joomla: version 5.0.0-5.0.1 only; version 1.0.0-4.0.0 only

Published 2025-08-15. Last modified 2026-06-17.