Developer Network™ There is always a great deal of Joomla! development activity underway and communicating with other developers in the community is essential. This site is a resource for anyone looking to build or maintain software based on the Joomla! platform.
Where to Start
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Moderate
- Probability: Low
- Versions: 4.0.0-5.4.6,6.0.0-6.1.1
- Exploit type: XSS
- Reported Date: 2026-05-15
- Fixed Date: 2026-07-07
- CVE Number: CVE-2026-48953
Description
Lack of escaping leads to an XSS vulnerability in the generic image output layout.
Affected Installs
Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.1
Solution
Upgrade to version 5.4.7, 6.1.2
Contact
The JSST at the Joomla! Security Centre.
Reported By: Pavel Kohout, Aisle Research
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Moderate
- Probability: Low
- Versions: 4.0.0-5.4.6,6.0.0-6.1.1
- Exploit type: XSS
- Reported Date: 2026-05-21
- Fixed Date: 2026-07-07
- CVE Number: CVE-2026-48952
Description
Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.
Affected Installs
Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.1
Solution
Upgrade to version 5.4.7, 6.1.2
Contact
The JSST at the Joomla! Security Centre.
Reported By: 廖双
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Moderate
- Probability: Low
- Versions: 4.0.0-5.4.6,6.0.0-6.1.1
- Exploit type: XSS
- Reported Date: 2026-05-07
- Fixed Date: 2026-07-07
- CVE Number: CVE-2026-48951
Description
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
Affected Installs
Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.1
Solution
Upgrade to version 5.4.7, 6.1.2
Contact
The JSST at the Joomla! Security Centre.
Reported By: Jorian Woltjer