CVE-2010-3426

CVE-2010-3426 describes a directory traversal vulnerability in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla!, allowing remote attackers to include and execute arbitrary local files. This is achieved by manipulating the 'controller' parameter with a ".. (dot dot)" sequence. The vulnerability has a CVSS score of 7.5, indicating high severity with an easily exploitable network-based attack that requires no authentication and can lead to partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, exploit code is publicly available via ExploitDB and Nuclei templates, though there is no evidence of active exploitation or significant community discussion.