CVE-2026-75115 affects YOOtheme Pro's Filesystem source component in versions 2.3.0 through 5.0.40. The vulnerability allows authenticated, privileged users to bypass path filtering through glob metacharacters (*, ?, and character classes like [abc]) injected into filesystem path parameters. This enables directory traversal and arbitrary file read within the configured filesystem sources.
The core issue is that glob pattern matching — a powerful regex-adjacent tool — was exposed directly to user-controlled input in a security-sensitive filter. This is not a novel bug; it's the same class of vulnerability that has repeatedly surfaced across Joomla extensions, WordPress plugins, and Drupal modules for over fifteen years. Each instance follows the same genetic sequence: expose filesystem primitives, rely on 'authenticated-but-not-admin' as the security boundary, and fail when pattern injection bypasses that boundary.
Two practical implications for defenders. First, audit your YOOtheme Pro installations for any user role with Filesystem source access — these are the privilege tiers that can trigger this bypass. The 'authenticated, privileged' label in the CVE should not create false comfort: this tier often has weaker monitoring than true administrators while having broader access than content-only users, creating maximum blast radius. Second, treat glob-based path filtering as a red flag in any CMS extension audit. The pattern-matching primitives developers reach for convenience are the same tools in an attacker's toolkit — this collision is predictable and has been documented repeatedly.
The CVSS of 7 reflects technical severity but obscures how trivially this attack surface was created. The real remediation question is not just 'patch this CVE' but whether any user role should have direct filesystem-expression capabilities when filesystem-selection capabilities would suffice.