Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um Angriffe wie Cross-Site Scripting (XSS), SQL-Injection, Privilegienerweiterung, Umgehung der Authentifizierung, Path Traversal, Local File Inclusion (LFI) und unbefugten Zugriff durchzuführen.
Product
Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 20
-
Critical 9.8
Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
-
High 8.6
Joomla! Core - [20260508] - Improper access check in com_config webservice endpoints
An improper access check allows unauthorized access to com_config webservice endpoints.
-
High 8.2
Joomla! Core - [20260511] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
-
High 8.2
Joomla! Core - [20260512] - MFA Authentication Bypass
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
-
High 8.2
Joomla! Core - [20260513] - Privilege escalation through com_users batch task
An improper access check allows privilege escalation through the com_users batch task.
-
High 8.2
Joomla! Core - [20260514] - Privilege escalation through com_users webservice endpoints
An improper access check allows privelege escalation through the com_users group editing webservice endpoint.
-
High 7.5CVE-2026-40383 EPSS 13%
Joomla! Core - [20260509] - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability.
-
High 7.5
Joomla! Core - [20260517] - Incorrect Cache Key Construction for InputFilter objects
The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.
-
Medium 6.9
Joomla! Core - [20260501] - XSS in feed modules
Lack of output escaping leads to a XSS vector in the feed modules.
-
Medium 6.9
Joomla! Core - [20260502] - XSS in com_associations
Lack of output escaping leads to a XSS vector in the multilingual associations component.
-
Medium 6.9
Joomla! Core - [20260503] - XSS in com_contenthistory
Lack of output escaping leads to a XSS vector in the content history component.
-
Medium 6.9
Joomla! Core - [20260504] - XSS in readmore links
Lack of output escaping leads to a XSS vector in the readmore links for com_content.
-
Medium 6.9
Joomla! Core - [20260506] - Authenticated blind SQLi in com_finder
Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.
-
Medium 6.9
Joomla! Core - [20260507] - Authenticated blind SQLi in com_tags
Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.
-
Medium 6.9
Joomla! Framework - [20260519] - Inadequate content filtering within the checkAttribute filter code.
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
-
Medium 6.9
Joomla! Framework - [20260520] - Inadequate content filtering within the cleanAttributes filter code.
Lack of input filtering leads to an XSS vector in the HTML filter code.
-
Medium 6.4
Joomla! Core - [20260516] - Incorrect Access Control in com_scheduler
An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.
-
Medium 5.9
Joomla! Core - [20260510] - Path traversal in com_media webservice endpoint
An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.
-
Medium 5.3
Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins
An improper access check allows privilege escalation through the com_users batch task.
-
Medium 4.6
Joomla! Core - [20260505] - CSRF in user activation endpoint
Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.
Revision history
-
#2
PoCs aufgenommen
-
#1
Initiale Fassung
References
-
Joomla 6.1.1 & 5.4.6 Security & Bugfix Release vom 2026-05-26
https://www.joomla.org/announcements/release-news/5954-joomla-6-1-1-5-4-6-security-bugfix-release.html
-
Joomla Security Advisory 20260501 vom 2026-05-26
https://developer.joomla.org/security-centre/1033-20260501-core-xss-in-feed-modules.html
-
Joomla Security Advisory 20260502 vom 2026-05-26
https://developer.joomla.org/security-centre/1034-20260502-core-xss-in-com-associations.html
-
Joomla Security Advisory 20260503 vom 2026-05-26
https://developer.joomla.org/security-centre/1035-20260503-core-xss-in-com-contenthistory
-
Joomla Security Advisory 20260504 vom 2026-05-26
https://developer.joomla.org/security-centre/1036-20260504-core-xss-in-readmore-links
-
Joomla Security Advisory 20260505 vom 2026-05-26
https://developer.joomla.org/security-centre/1037-20260505-core-csrf-in-user-activation-endpoint
-
Joomla Security Advisory 20260506 vom 2026-05-26
https://developer.joomla.org/security-centre/1038-20260506-core-authenticated-blind-sqli-in-com-finder.html
-
Joomla Security Advisory 20260507 vom 2026-05-26
https://developer.joomla.org/security-centre/1039-20260507-core-authenticated-blind-sqli-in-com-tags.html
-
Joomla Security Advisory 20260508 vom 2026-05-26
https://developer.joomla.org/security-centre/1040-20260508-core-improper-access-check-in-com-config-webservice-endpoints.html
-
Joomla Security Advisory 20260509 vom 2026-05-26
https://developer.joomla.org/security-centre/1041-20260509-core-lfi-in-htmlview-layout-parameter.html
-
Joomla Security Advisory 20260510 vom 2026-05-26
https://developer.joomla.org/security-centre/1042-20260510-core-path-traversal-in-com-media-webservice-endpoint.html
-
Joomla Security Advisory 20260511 - Core - MFA Authentication Bypass vom 2026-05-26
https://developer.joomla.org/security-centre/1043-20260511-core-mfa-authentication-bypass.html
-
Joomla Security Advisory 20260512 - Core - MFA Authentication Bypass vom 2026-05-26
https://developer.joomla.org/security-centre/1044-20260512-core-mfa-authentication-bypass.html
-
Joomla Security Advisory 20260513 - Core - Privilege escalation through com_users batch task vom 2026-05-26
https://developer.joomla.org/security-centre/1045-20260513-core-privilege-escalation-through-com-users-batch-task.html
-
Joomla Security Advisory 20260515 - Core - Incorrect Access Control in sample data plugins vom 2026-05-26
https://developer.joomla.org/security-centre/1047-20260515-core-incorrect-access-control-in-sample-data-plugins.html
-
Joomla Security Advisory 20260516 - Core - Incorrect Access Control in com_scheduler vom 2026-05-26
https://developer.joomla.org/security-centre/1048-20260516-core-incorrect-access-control-in-com-scheduler.html
-
Joomla Security Advisory 20260517 - Core - Incorrect Cache Key Construction for InputFilter objects vom 2026-05-26
https://developer.joomla.org/security-centre/1049-20260517-core-incorrect-cache-key-construction-for-inputfilter-objects.html
-
Joomla Security Advisory 20260518 - Core - Transport encryption downgrade for password and username reset links vom 2026-05-26
https://developer.joomla.org/security-centre/1050-20260518-core-transport-encryption-downgrade-for-password-and-username-reset-links.html
-
Joomla Security Advisory 20260519 - Framework - Inadequate content filtering within the checkAttribute filter code vom 2026-05-26
https://developer.joomla.org/security-centre/1051-20260519-framework-inadequate-content-filtering-within-the-checkattribute-filter-code.html
-
Joomla Security Advisory 20260514 - Core - Privilege escalation through com_users webservice endpoints vom 2026-05-26
https://developer.joomla.org/security-centre/1046-20260514-core-privilege-escalation-through-com-users-webservice-endpoints.html
-
Joomla Security Advisory 20260520 - Framework - Inadequate content filtering within the cleanAttributes filter code vom 2026-05-26
https://developer.joomla.org/security-centre/1052-20260520-framework-inadequate-content-filtering-within-the-cleanattributes-filter-code.html
-
Joomla Exploits vom 2026-07-08
https://github.com/aramosf/joomla_exploits