Executive brief
Joomla! CMS, a popular platform for building and managing websites, contains a security flaw in its content filtering system. This vulnerability could allow an attacker with high-level administrative privileges to inject malicious scripts into web pages. If successful, this could lead to unauthorized actions being performed in the context of other users' sessions or the theft of sensitive information.
Technical details
A cross-site scripting (XSS) vulnerability exists in the Joomla! Framework and CMS within the 'cleanAttributes' filter code. The root cause is a lack of sufficient input filtering, which fails to properly neutralize malicious payloads before they are rendered in HTML. An attacker with high privileges (PR:H) can exploit this over the network, though it requires some level of user interaction (UI:P). Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser. The issue is addressed in Joomla! CMS versions 5.4.6 and 6.1.1.
Affected products
- Joomla! Project Joomla! CMS 3.0.0-5.4.5, 6.0.0-6.1.0
Timeline
- 2026-05-04: disclosed: Reported to the Joomla! Security Centre
- 2026-05-26: patched: Fixed in versions 5.4.6 and 6.1.1
- 2026-05-26: advisory