Developer Network™ There is always a great deal of Joomla! development activity underway and communicating with other developers in the community is essential. This site is a resource for anyone looking to build or maintain software based on the Joomla! platform.
Where to Start
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Moderate
- Probability: Low
- Versions: 4.2.0-5.4.6,6.0.0-6.1.1
- Exploit type: XSS
- Reported Date: 2026-05-07
- Fixed Date: 2026-07-07
- CVE Number: CVE-2026-48949
Description
Lack of validation leads to an XSS vulnerability in the MFA management views.
Affected Installs
Joomla! CMS versions 4.2.0-5.4.5,6.0.0-6.1.1
Solution
Upgrade to version 5.4.7, 6.1.2
Contact
The JSST at the Joomla! Security Centre.
Reported By: Jorian Woltjer
- Project: Joomla!
- SubProject: CMS
- Impact: Low
- Severity: Low
- Probability: Low
- Versions: 3.0.0-5.4.6,6.0.0-6.1.1
- Exploit type: Incorrect Access Control
- Reported Date: 2026-05-07
- Fixed Date: 2026-07-07
- CVE Number: CVE-2026-48948
Description
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
Affected Installs
Joomla! CMS versions 3.0.0-5.4.5,6.0.0-6.1.1
Solution
Upgrade to version 5.4.7, 6.1.2
Contact
The JSST at the Joomla! Security Centre.
Reported By: Jorian Woltjer
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Low
- Probability: Low
- Versions: 4.1.0-5.4.6,6.0.0-6.1.1
- Exploit type: Incorrect Access Control
- Reported Date: 2026-05-05
- Fixed Date: 2026-07-07
- CVE Number: CVE-2026-48947
Description
An improper access check allows privileged users to overwrite media files without editing permissions.
Affected Installs
Joomla! CMS versions 4.1.0-5.4.6,6.0.0-6.1.1
Solution
Upgrade to version 5.4.7, 6.1.2
Contact
The JSST at the Joomla! Security Centre.
Reported By: Federico Brasili