CVE-2020-9364

CVE-2020-9364 is a directory traversal vulnerability found in the Creative Contact Form extension 4.6.2 (and earlier versions) for Joomla!. An unauthenticated attacker could exploit this flaw by manipulating the filename field for uploaded attachments, specifically through the creativecontactform_upload parameter. This allows them to receive arbitrary files from the server's filesystem via email if the "Send me a copy" option is enabled. The vulnerability has a CVSS score of 5.3 (Medium), indicating a low attack complexity and no user interaction required, leading to a potential impact of information disclosure. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is there evidence of active exploitation or significant community discussion.