Junglewise Threat Intelligence

CVE-2026-35222: Joomla! CMS SQL injection in com_tags

CVE-2026-35222 · Severity: info · CVSS 6.9 · Published 2026-05-26

Technologies: Joomla CMS. Vendors: Joomla.

Executive brief

Joomla!, a popular website management platform, contains a security flaw in its tagging component. An attacker with administrative privileges could exploit this to perform unauthorized database queries, potentially leading to the exposure of sensitive site information. This could compromise the confidentiality of user data or site configurations.

Technical details

A blind SQL injection vulnerability exists in the Joomla! CMS 'com_tags' component. The flaw is caused by improper validation of 'order' clauses within database queries. An attacker with high-level administrative privileges (PR:H) can exploit this over the network to execute arbitrary SQL commands. While the impact is primarily limited to data confidentiality (VC:H), it allows for the extraction of information from the database that should otherwise be restricted. The issue is fixed in Joomla! versions 5.4.6 and 6.1.1.

Affected products

  • Joomla! CMS 4.0.0 - 5.4.5, 6.0.0 - 6.1.0

Timeline

  • 2026-03-31: disclosed: Reported to Joomla! Project
  • 2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
  • 2026-05-26: advisory

References