Skip to content
OpenAdvisories
Critical · 9.8 CVE-2022-23799 BIT-joomla-2022-23799EUVD-2022-1302GHSA-49fj-qp6p-q544

[20220307] - Core - Variable Tampering on JInput $_REQUEST data

Published Mar 30, 2022 · Updated Feb 25, 2026 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Product: joomla/input Package: joomla/input Category: Web / CMS Ecosystem: Packagist

Description

An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data.

Affected products

VendorProductAffectedFixed
Joomla! Project Joomla! CMS 4.0.0-4.1.0 —
Joomla! Project joomla/input 2.0.0-2.0.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist joomla/input >= 2.0.0, < 2.0.2 2.0.2 GHSA-49fj-qp6p-q544

References