Executive brief
A vulnerability in the Joomla! content management system could allow for incorrect data filtering due to a flaw in how the system caches security settings. Joomla! is a popular platform used to build and manage websites. If exploited, this could lead to security policies being bypassed because the system might reuse a cached filter that was intended for a different, less restrictive context.
Technical details
The vulnerability exists within the Joomla! CMS core InputFilter::getInstance() method. The root cause is an incorrect cache key construction where a security-sensitive parameter is omitted from the key used to store and retrieve InputFilter instances. This flaw can lead to a cache collision or the reuse of an inappropriate filter instance across different contexts. An attacker might leverage this to bypass intended input sanitization or validation logic if a less restrictive filter is served from the cache. The issue is resolved in Joomla! CMS versions 5.4.6 and 6.1.1.
Affected products
- Joomla! CMS 4.0.0 - 5.4.5, 6.0.0 - 6.1.0
Timeline
- 2025-11-14: other: Reported date
- 2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
- 2026-05-26: disclosed: Public disclosure of CVE-2026-48901