# CVE-2026-48952: Joomla! CMS XSS in com_installer update list view

Source: https://junglewise.ai/threats/cve-2026-48952-joomla-cms-xss-in-com-installer-update-list-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-48952 · Severity: info · CVSS 5.9 · Published 2026-07-07

Joomla! CMS, a popular platform for building and managing websites, contains a security flaw in its extension installer component. An attacker with high-level administrative privileges could potentially inject malicious scripts into the update list view. If another administrator views this list, the script could execute, potentially leading to unauthorized actions or data theft within the management console.

## Quick answers

**Is CVE-2026-48952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48952 being exploited in the wild.

**How severe is CVE-2026-48952?** Informational severity, with a CVSS score of 5.9, published 7 July 2026.

**Which products and versions are affected?** Joomla! Project Joomla! CMS 4.0.0 - 5.4.6, 6.0.0 - 6.1.1.

**Is there a fix for CVE-2026-48952?** A patch was published on 2026-07-07: Fixed in versions 5.4.7 and 6.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48952 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48952?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Joomla! CMS 'com_installer' component. The issue stems from a lack of proper output escaping within the update list view. An attacker with high privileges (PR:H) can exploit this by injecting malicious payloads that execute in the context of another user's browser when they navigate to the affected view. This vulnerability is tracked as CVE-2026-48952 and has been addressed in Joomla! CMS versions 5.4.7 and 6.1.2.

## Affected products

- Joomla! Project Joomla! CMS 4.0.0 - 5.4.6, 6.0.0 - 6.1.1

## Timeline

- 2026-05-21: disclosed: Vulnerability reported to Joomla! Project
- 2026-07-07: patched: Fixed in versions 5.4.7 and 6.1.2
- 2026-07-07: advisory

## References

- [https://developer.joomla.org/security-centre/1060-20260706-core-xss-in-com-installer.html](https://developer.joomla.org/security-centre/1060-20260706-core-xss-in-com-installer.html)