Developer Network™

Download
Launch

Security Announcements

This feed provides announcements of resolved security issues in Joomla! software releases.

For more information about the Joomla! Security Strike Team (JSST) and its processes, please review our Security article.

To report potential security issues, please follow the guidelines in the above referenced article. Please note that we are only able to provide support for the Joomla! CMS, Joomla! Framework, and *.joomla.org network of websites.

You can subscribe to notifications from this feed through a RSS reader.

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5,6.0.0-6.1.0
  • Exploit type: SQLi
  • Reported Date: 2026-03-31
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-352212

Description

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Adrian Junge aka vurlo, Federico Brasili

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 5.4.0-5.4.5,6.0.0-6.1.0
  • Exploit type: SQLi
  • Reported Date: 2026-03-31
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-35221

Description

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

Affected Installs

Joomla! CMS versions 5.4.0-5.4.5,6.0.0-6.1.0

Solution

Upgrade to version 5.4.6,6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Adrian Junge aka vurlo

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 6.0.0-6.1.0
  • Exploit type: CSRF
  • Reported Date: 2026-03-28
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-35220

Description

Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.

Affected Installs

Joomla! CMS versions 6.0.0-6.1.0

Solution

Upgrade to version 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Sun HuangnSec

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-04-14
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-30895

Description

Lack of output escaping leads to a XSS vector in the content history component.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  peterhulst

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-04-01
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-30894

Description

Lack of output escaping leads to a XSS vector in the content history component.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Phan Phan Hai Long

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-04-01
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-25901

Description

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  vnth4nhnt from CyStack, Pavel Kohout from Aisle Research

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.0.0-5.4.5, 6.0.0-6.1.0
  • Exploit type: XSS
  • Reported Date: 2026-03-28
  • Fixed Date: 2026-05-26
  • CVE Number: CVE-2026-25900

Description

Lack of output escaping leads to a XSS vector in the feed modules.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.5, 6.0.0-6.1.0

Solution

Upgrade to version 5.4.6 or 6.1.1

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Mohamed Elabbas, Sun Huang

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Probability: Moderate
  • Versions: 3.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-03-11
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-21629

Description

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

Affected Installs

Joomla! CMS versions 3.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  JSST

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Probability: Moderate
  • Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: SQLi
  • Reported Date: 2026-03-05
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-21630

Description

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Antonio Morales from GitHub Security Lab Taskflow Agent / vnth4nhnt from CyStack

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: XSS
  • Reported Date: 2026-03-11
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-21631

Description

Lack of output escaping leads to a XSS vector in the multilingual associations component

Affected Installs

Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Shirsendu Mondal & Md Tanzimul Alam Fahim, UNC Pembroke

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: XSS
  • Reported Date: 2026-03-10
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-21632

Description

Lack of output escaping for article titles leads to XSS vectors in various locations.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  peter vanderhulst

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: High
  • Probability: Low
  • Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: Arbitrary File Deletion
  • Reported Date: 2026-03-16
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-23898

Description

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Phil Taylor

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: High
  • Probability: Low
  • Versions: 4.0.0-5.4.3, 6.0.0-6.0.3
  • Exploit type: Incorrect Access Control
  • Reported Date: 2026-03-09
  • Fixed Date: 2026-03-31
  • CVE Number: CVE-2026-23899

Description

An improper access check allows unauthorized access to webservice endpoints.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.3, 6.0.0-6.0.3

Solution

Upgrade to version 5.4.4 or 6.0.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  vnth4nhnt from CyStack

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-5.4.1, 6.0.0-6.0.1
  • Exploit type: XSS
  • Reported Date: 2025-11-14
  • Fixed Date: 2026-01-06
  • CVE Number: CVE-2025-63082

Description

Lack of input filtering leads to an XSS vector in the HTML filter code related to data URLs in img tags.

Affected Installs

Joomla! CMS versions 4.0.0-5.4.1, 6.0.0-6.0.1

Solution

Upgrade to version 5.4.2 or 6.0.2

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Sho Sugiyama of SUZUKI MOTOR CORPORATION

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.9.0-5.4.1, 6.0.0-6.0.1
  • Exploit type: XSS
  • Reported Date: 2025-09-29
  • Fixed Date: 2026-01-06
  • CVE Number: CVE-2025-63083

Description

Lack of output escaping leads to a XSS vector in the pagebreak and pagenavigation plugins.

Affected Installs

Joomla! CMS versions 3.9.0-5.4.1, 6.0.0-6.0.1

Solution

Upgrade to version 5.4.2 or 6.0.2

Contact

The JSST at the Joomla! Security Centre.

Reported By:  peterhulst

  • Project: Joomla! / Joomla! Framework
  • SubProject: CMS / filter
  • Impact: Moderate
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 3.0.0-3.10.20-elts, 4.0.0-4.4.13, 5.0.0-5.3.3
  • Exploit type: XSS
  • Reported Date: 2025-08-03
  • Fixed Date: 2025-09-30
  • CVE Number: CVE-2025-54476

Description

Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.

Affected Installs

Joomla! CMS versions 3.0.0-3.10.20-elts, 4.0.0-4.4.13, 5.0.0-5.3.3

Solution

Upgrade to version 4.4.14 or 5.3.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Flydragon, Poi, Cwy, Xtrimi

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Moderate
  • Severity: Low
  • Probability: Low
  • Versions: 4.0.0-4.4.13, 5.0.0-5.3.3
  • Exploit type: User Enumeration
  • Reported Date: 2025-09-04
  • Fixed Date: 2025-09-30
  • CVE Number: CVE-2025-54477

Description

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.

Affected Installs

Joomla! CMS versions 4.0.0-4.4.13, 5.0.0-5.3.3

Solution

Upgrade to version 4.4.14 or 5.3.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Marco Schubert

  • Project: Joomla!
  • SubProject: Framework
  • Impact: High
  • Severity: Low
  • Probability: Low
  • Versions: 1.0.0-2.1.1, 3.0.0-3.3.1
  • Exploit type: SQL Injection
  • Reported Date: 2025-03-17
  • Fixed Date: 2025-04-02
  • CVE Number: CVE-2025-25226

Description

Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package.

Affected Installs

Database Package version: 1.0.0-2.1.1, 3.0.0-3.3.1

Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.

Solution

Upgrade to version 2.2.0 or 3.4.0

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Nicholas K. Dionysopoulos, akeeba.com

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Moderate
  • Probability: Moderate
  • Versions: 4.0.0 - 4.4.12, 5.0.0 - 5.2.5
  • Exploit type: Authentication Bypass
  • Reported Date: 2025-03-20
  • Fixed Date: 2025-04-08
  • CVE Number: CVE-2025-25227

Description

Insufficient state checks lead to a vector that allows to bypass 2FA checks.

Affected Installs

Joomla! CMS versions: 4.0.0 - 4.4.12, 5.0.0 - 5.2.5

Solution

Upgrade to version 4.4.13 or 5.2.6

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Undisclosed Reporter

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Critical
  • Severity: Low
  • Probability: Low
  • Versions: 4.0.0-4.4.11, 5.0.0-5.2.4
  • Exploit type: Malicious file upload
  • Reported Date: 2025-02-25
  • Fixed Date: 2025-03-10
  • CVE Number: CVE-2025-22213

Description

Inadequate checks in the Media Manager allowed users with "edit" privileges to create executable PHP files.

Affected Installs

Joomla! CMS versions 4.0.0-4.4.11, 5.0.0-5.2.4

Solution

Upgrade to version 4.4.12 or 5.2.5

Contact

The JSST at the Joomla! Security Centre.

Reported By:  ErPaciocco

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.9.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2
  • Exploit type: ACL Violation
  • Reported Date: 2024-08-26
  • Fixed Date: 2025-01-07
  • CVE Number: CVE-2024-40749

Description

Improper Access Controls allows access to protected views.

Affected Installs

Joomla! CMS versions 3.9.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2

Solution

Upgrade to version 3.10.20-elts, 4.4.10 or 5.2.3

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Dominik Ziegelmüller

  • Project: Joomla!
  • SubProject: CMS
  • Impact: High
  • Severity: Low
  • Probability: Low
  • Versions: 4.1.0-4.4.10, 5.0.0-5.2.3
  • Exploit type: SQL Injection
  • Reported Date: 2024-12-10
  • Fixed Date: 2025-02-18
  • CVE Number: CVE-2025-22207

Description

Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler

Affected Installs

Joomla! CMS versions 4.1.0-4.4.10, 5.0.0-5.2.3

Solution

Upgrade to version 4.4.11 or 5.2.4

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Calum Hutton, snyk.io

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.0.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2
  • Exploit type: XSS
  • Reported Date: 2024-09-19
  • Fixed Date: 2025-01-07
  • CVE Number: CVE-2024-40748

Description

Lack of output escaping in the id attribute of menu lists.

Affected Installs

Joomla! CMS versions 3.0.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2

Solution

Upgrade to version 3.10.20-elts, 4.4.10 or 5.2.3

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Lokesh Dachepalli

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Probability: Low
  • Versions: 4.0.0-4.4.9, 5.0.0-5.2.2
  • Exploit type: XSS
  • Reported Date: 2024-08-29
  • Fixed Date: 2025-01-07
  • CVE Number: CVE-2024-40747

Description

Various module chromes didn't properly process inputs, leading to XSS vectors.

Affected Installs

Joomla! CMS versions 4.0.0-4.4.9, 5.0.0-5.2.2

Solution

Upgrade to version 4.4.10 or 5.2.3

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Catalin Iovita

  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Moderate
  • Probability: Low
  • Versions: 3.0.0-3.10.16-elts, 4.0.0-4.4.6, 5.0.0-5.1.2
  • Exploit type: XSS
  • Reported Date: 2024-07-22
  • Fixed Date: 2024-08-20
  • CVE Number: CVE-2024-40743

Description

The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors.

Affected Installs

Joomla! CMS versions 3.0.0-3.10.16-elts, 4.0.0-4.4.6, 5.0.0-5.1.2

Solution

Upgrade to version 3.10.17-elts, 4.4.7 or 5.1.3

Contact

The JSST at the Joomla! Security Centre.

Reported By:  Jesper den Boer

Page 2 of 13