Joomla Archives - Standoutmedia A/S

Cross-Site Scripting in Joomla Language Overrides

Skrevet den 22. oktober 2026 af i Joomla

A non-super-administrator with access to the language overrides feature can store single or double quotes in an override value, producing a stored XSS payload that executes when the override string is rendered in the administrator interface. The fix rejects quotes in override values for users lacking the core.admin privilege.

This vulnerability affects the following application versions:

MFA Bypass via Premature Remember Me Cookie in Joomla

Skrevet den 2. oktober 2026 af i Joomla

The cookie authentication plugin issued a persistent Remember Me cookie immediately after password authentication, before any required Multi-factor Authentication (MFA) step was completed. An attacker who knows a victim’s password could obtain a valid persistent credential and bypass MFA. The fix defers issuing the cookie until the login is fully complete (including MFA).

This vulnerability affects the following application versions:

Arbitrary Directory Deletion via Path Traversal in Joomla Cache File Storage

Skrevet den 2. oktober 2026 af i Joomla

The Joomla file cache storage handler appended the cache group name to the cache root without rejecting ‘..’ segments, so the containment check in FileStorage::_deleteFolder() could be bypassed. An administrator-area user with access to Cache Management (com_cache) could submit a crafted group such as ../../images to the cache clean action and recursively delete directories outside the cache folder.

This vulnerability affects the following application versions:

Incorrect Access Control in Joomla com_users Access Level API

Skrevet den 2. oktober 2026 af i Joomla

Joomla’s access-level API endpoints inherited permissive default permission checks, so an authenticated user with only create or edit rights on com_users could add or modify access levels. The fix requires core.admin instead.

This vulnerability affects the following application versions:

Incorrect Access Control in Joomla webservice edit tasks

Skrevet den 2. oktober 2026 af i Joomla

Joomla’s API edit endpoints checked only the component-wide core.edit permission, ignoring per-item ownership and asset rules. An authenticated user could edit records they were not entitled to modify. The fix checks the record’s own asset and core.edit.own.

This vulnerability affects the following application versions:

Cross-Site Scripting in Joomla Media Field Audio/Video Layouts

Skrevet den 2. oktober 2026 af i Joomla

The generic audio and video output layouts in Joomla 6.1 escaped only the src attribute and printed every other attribute value, attribute name and thetype raw. A content editor who can set media custom field values (such as a video poster) can inject JavaScript that runs in the browser of any visitor or administrator viewing the item.

This vulnerability affects the following application versions:

Joomla 6.1.0
Joomla 6.1.1
Joomla 6.1.2
Joomla 6.1.3

Cross-Site Scripting in Joomla HTMLHelper Link and Iframe Methods

Skrevet den 2. oktober 2026 af i Joomla

HTMLHelper::link() and HTMLHelper::iframe() wrote the supplied URL, the iframe name and any array-supplied HTML attributes into the output without escaping them. Any core or third-party caller that passes a user-influenced URL or attribute value therefore produced an attribute breakout, letting an attacker run arbitrary JavaScript in a visitor’s browser.

This vulnerability affects the following application versions:

Cross-Site Scripting in Joomla HTML Mail Templates

Skrevet den 2. oktober 2026 af i Joomla

When Joomla rendered an HTML e-mail through a mail layout, MailTemplate::send() substituted template tags without HTML escaping. User-supplied values such as a contact form’s sender name, e-mail and message, a private message subject, and the name and username used in registration, activation, reminder and password-reset mails were inserted raw, so a visitor could inject markup into e-mails read by site owners and administrators.

This vulnerability affects the following application versions:

Cross-Site Scripting in Joomla Toolbar Link Layout

Skrevet den 2. oktober 2026 af i Joomla

The toolbar link layout printed a button’s id, CSS class and URL straight into HTML attributes without escaping them. Where any of those values derive from request or user-supplied data, an attacker could break out of the attribute and run arbitrary JavaScript in the browser of an administrator viewing the page.

This vulnerability affects the following application versions:

Improper Access Control in Joomla Workflow Stage Batch Change

Skrevet den 2. oktober 2026 af i Joomla

Joomla’s batch workflow-stage action (WorkflowBehaviorTrait::batchWorkflowStage) recorded an error when the user lacked core.admin permission but did not stop, so a backend user with batch access could still move content they are not allowed to manage to any workflow stage. Only sites with workflows enabled (off by default) are affected.

This vulnerability affects the following application versions:

Information Disclosure in Joomla Tagged Items Listings

Skrevet den 2. oktober 2026 af i Joomla

Joomla’s Tags component and the Popular Tags and Similar Tags modules checked each tagged item’s own access level but ignored the access level of its category, so an item left Public inside a Registered- or Special-only category was listed (title, alias, text excerpt) to visitors who are not allowed to view that category. Any unauthenticated visitor of a Joomla 4.0 or later site that restricts content at the category level is affected.

This vulnerability affects the following application versions:

Server-Side Request Forgery in Joomla Core URL Fields

Skrevet den 2. oktober 2026 af i Joomla

Several Joomla core forms validated URL fields without restricting the allowed schemes, so the News Feeds link, the Feed Display module, the Scheduled Tasks GET request and the Joomla Update custom source accepted file://, gopher://, ldap:// and similar URLs. A manager-level user, or a user who can create modules or scheduled tasks, could make the server read local files or reach internal services.

This vulnerability affects the following application versions:

Stored Cross-Site Scripting in Joomla Administrator Module List

Skrevet den 2. oktober 2026 af i Joomla

The administrator Modules list printed each module’s position into the row’s data-draggable-group attribute without escaping it. A user permitted to edit modules could store a crafted position value that breaks out of the attribute and runs arbitrary JavaScript in the browser of a Super User viewing the module list.

This vulnerability affects the following application versions:

Unauthorized User Account Creation in Joomla Profile Save Controller

Skrevet den 2. oktober 2026 af i Joomla

The com_users profile.save task never checked that the visitor was logged in. An unauthenticated visitor could submit the profile form and get a new user account created, even on sites with user registration disabled.

This vulnerability affects the following application versions:

Cross-Site Scripting filter bypass in Joomla InputFilter

Skrevet den 2. oktober 2026 af i Joomla

Joomla’s InputFilter did not decode attribute values the way a browser does before checking them for dangerous URL schemes. HTML5 entities, unterminated numeric references and whitespace inside data URIs bypassed the filter, allowing stored XSS.

This vulnerability affects the following application versions:

Improper Access Control in Joomla Content History Comparison

Skrevet den 2. oktober 2026 af i Joomla

The content history comparison view checked edit permission only for the first of the two compared history versions. A backend user with content-editing rights could pair a version they may edit with a version of an item they cannot access and read old revisions of that item’s content.

This vulnerability affects the following application versions:

Improper ACL checks for batch copy actions

Skrevet den 25. august 2026 af i Joomla

Batch copy operations did not verify that the caller may edit the source records, so a user could copy items they were not allowed to edit (and thereby obtain an editable copy of their content). The fix adds a core.edit authorisation check on each source record’s asset in the generic AdminModel::batchCopy() and in the component-specific batchCopy() overrides.

This vulnerability affects the following application versions:

Improper CORS Origin Validation in Joomla Web Services API

Skrevet den 25. august 2026 af i Joomla

The Joomla API application reflected any incoming Origin header back in Access-Control-Allow-Origin and set Access-Control-Allow-Credentials: true, so the configured cors_allow_origin whitelist was never enforced. Any website could therefore make credentialed cross-origin requests to the site’s web services API and read the responses, exposing data available to the victim’s API session. The fix validates the request origin against the configured whitelist and only allows credentials for a validated origin.

This vulnerability affects the following application versions:

Privilege Escalation in Joomla Category Webservice Endpoints

Skrevet den 25. august 2026 af i Joomla

The com_categories API controller relied on the generic ApiController permission logic and never checked that the caller may manage the target extension, nor that the loaded category actually belongs to it. An authenticated user with only limited API access could therefore create, edit and delete categories of components they have no permissions for.

This vulnerability affects the following application versions:

Privilege Escalation in Joomla Web Services API ACL Checks

Skrevet den 25. august 2026 af i Joomla

The Joomla web services API only checked the fine-grained core.create, core.edit and core.delete permissions for a component, without requiring the core.manage permission that the administrator interface enforces. A user who was denied access to a component in the backend could still create, edit and delete that component’s records through the API endpoints. The fix adds a core.manage precondition to the API controllers’ allowAdd()/allowEdit() checks and introduces a dedicated allowDelete() check used by the delete endpoint.

This vulnerability affects the following application versions:

Response Header Injection in Joomla Download Views

Skrevet den 25. august 2026 af i Joomla

The banner tracks export and contact vCard download views did not process the generated download filename, letting an attacker inject a double quote to break out of the Content-Disposition header. This enables response header injection, reflected file download and content-type confusion against site visitors.

This vulnerability affects the following application versions:

Unrestricted uploads of SHTML files

Skrevet den 25. august 2026 af i Joomla

The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

This vulnerability affects the following application versions:

XSS through schema.org outputs

Skrevet den 25. august 2026 af i Joomla

The schema.org JSON-LD emitted by the system plugin and by the breadcrumbs module was serialised without HTML-escaping flags, so content containing tag or quote characters could break out of the inline