Unscored CVE-2021-26032 EUVD-2021-12855GHSA-jjxj-55qc-vc28

[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload

Published May 26, 2021 · Updated Feb 25, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.

Affected products

Vendor	Product	Affected	Fixed
Joomla! Project	Joomla! CMS	3.0.0-3.9.26	—

References

https://developer.joomla.org/security-centre/852-20210501-core-adding-html-to-the-executable-block-list-of-mediahelper-canupload.html vendor-advisory