Medium severity · published Aug 21, 2026
CVE-2026-76611
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66
6.9
CVSS
0.5%
EPSS
No
On KEV
Description
Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZE
Zoo extension for Joomla · yootheme.com
1.0.0-4.1.65 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76611
www.yootheme.com
https://www.yootheme.com/
More from Zoo extension for Joomla
10.0
CVE-2026-74803
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
9.3
CVE-2026-74804
Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64
8.6
CVE-2026-76612
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66
6.9
CVE-2026-76610
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
5.3
CVE-2026-77028
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66