Executive brief
JMedia, a media management extension for the Joomla content management system, is vulnerable to a security flaw that allows for the execution of malicious scripts. By uploading specially crafted image files, an attacker could potentially take control of user sessions or perform unauthorized actions on the website. This could lead to a full compromise of the site's data and administrative functions.
Technical details
The JMedia extension for Joomla (versions 1.0 through 1.5.4) contains a stored Cross-Site Scripting (XSS) vulnerability. The root cause is the failure to sanitize uploaded SVG files and the lack of a 'X-Content-Type-Options: nosniff' header when serving these files. An attacker with high privileges (required for media uploads) can upload a malicious SVG containing embedded JavaScript. When other users, including administrators, view the file, the script executes in their browser context, potentially allowing for session hijacking or unauthorized administrative actions. The Joomla! Project has assigned a CVSS 4.0 score of 9.4.
Affected products
- ThemeXpert JMedia extension for Joomla 1.0-1.5.4
Timeline
- 2026-07-20: advisory: CVE-2026-60034 published by NVD