Is CVE-2026-48903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48903 being exploited in the wild.

How severe is CVE-2026-48903?

Informational severity, with a CVSS score of 6.9, published 26 May 2026.

Which products and versions are affected?

Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0.

Is there a fix for CVE-2026-48903?

A patch was published on 2026-05-26: Fixed in versions 5.4.6 and 6.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48903 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-48903?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48903: Joomla! CMS cross-site scripting in checkAttribute methods

CVE-2026-48903 · Severity: info · CVSS 6.9 · Published 2026-05-26

Joomla!, a popular website management system, contains a security flaw that could allow high-privileged users to inject malicious scripts into the website. If exploited, this could lead to unauthorized actions being performed in the context of another user's session, potentially compromising sensitive data or site integrity. Organizations should update their Joomla! installations to the latest patched versions to mitigate this risk.

Quick answers

Is CVE-2026-48903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48903 being exploited in the wild.
How severe is CVE-2026-48903?: Informational severity, with a CVSS score of 6.9, published 26 May 2026.
Which products and versions are affected?: Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0.
Is there a fix for CVE-2026-48903?: A patch was published on 2026-05-26: Fixed in versions 5.4.6 and 6.1.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48903 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-48903?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-site scripting (XSS) vulnerability exists in Joomla! CMS versions 3.0.0 through 5.4.5 and 6.0.0 through 6.1.0. The issue stems from inadequate content filtering within the 'checkAttribute' methods of the Joomla! Framework. An attacker with high privileges (PR:H) can exploit this by injecting malicious scripts that are executed when a victim interacts with affected components. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has been addressed in Joomla! CMS versions 5.4.6 and 6.1.1.

Affected products

Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0

Timeline

2026-04-21: other: Reported date
2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
2026-05-26: disclosed: NVD publication date

References

https://developer.joomla.org/security-centre/1051-20260519-framework-inadequate-content-filtering-within-the-checkattribute-filter-code.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.