Executive brief
Joomla!, a popular website management platform, contains a security flaw in its tagging component. An attacker with administrative privileges could exploit this to perform unauthorized database queries, potentially leading to the exposure of sensitive site information. This could compromise the confidentiality of user data or site configurations.
Technical details
A blind SQL injection vulnerability exists in the Joomla! CMS 'com_tags' component. The flaw is caused by improper validation of 'order' clauses within database queries. An attacker with high-level administrative privileges (PR:H) can exploit this over the network to execute arbitrary SQL commands. While the impact is primarily limited to data confidentiality (VC:H), it allows for the extraction of information from the database that should otherwise be restricted. The issue is fixed in Joomla! versions 5.4.6 and 6.1.1.
Affected products
- Joomla! CMS 4.0.0 - 5.4.5, 6.0.0 - 6.1.0
Timeline
- 2026-03-31: disclosed: Reported to Joomla! Project
- 2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
- 2026-05-26: advisory