Is CVE-2026-102786 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102786 being exploited in the wild.

How severe is CVE-2026-102786?

Informational severity, published 23 October 2026.

Is there a fix for CVE-2026-102786?

Yes: fixed in 6.1.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102786 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102786?

Check whether you run Phoca Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102786: Phoca Gallery stored cross-site scripting through HTML attribute injection

CVE-2026-102786 · Severity: info · Published 2026-10-23

Phoca Gallery is a Joomla extension for managing image galleries on websites. An authenticated user can inject malicious code into HTML attributes, which is then stored and executed when other users view the gallery, potentially allowing account takeover or data theft. The vulnerability affects versions 4.5.0 through 6.1.5 and was fixed in version 6.1.6.

Vendors: Phoca.

Quick answers

Is CVE-2026-102786 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102786 being exploited in the wild.
How severe is CVE-2026-102786?: Informational severity, published 23 October 2026.
Which products and versions are affected?: Phoca Gallery 4.5.0 to 6.1.5.
Is there a fix for CVE-2026-102786?: Yes: fixed in 6.1.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102786 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102786?: Check whether you run Phoca Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 6.1.6

Technical details

This is an authenticated stored cross-site scripting (XSS) vulnerability caused by improper sanitization of HTML attributes in Phoca Gallery. An attacker with authentication credentials can inject malicious JavaScript into gallery content, which is persisted in the database and executed in the browsers of visitors viewing the gallery. The vulnerability requires authentication to exploit and affects a wide version range.

Affected products

Phoca Gallery 4.5.0 to 6.1.5

Timeline

2026-10-23: disclosed
2026-10-23: patched: Phoca Gallery 6.1.6 released as security release

References

https://www.phoca.cz/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.