Executive brief
RO CSVI, a popular Joomla extension used for importing and exporting data, contains a security vulnerability in how it handles certain web requests. An attacker could use this flaw to inject malicious scripts into the web pages of other users. If successful, this could allow the attacker to perform actions on behalf of users, potentially leading to unauthorized data access or account takeover within the Joomla site.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the rolandd.com RO CSVI extension for Joomla before version 9.11.0. The flaw is located within the AJAX endpoint handlers, which fail to properly neutralize user-supplied input before including it in web page generation (CWE-79). An unauthenticated or low-privileged remote attacker can exploit this by sending a specially crafted request to the vulnerable AJAX endpoints. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can be used to hijack sessions or perform unauthorized administrative actions. The issue is resolved in version 9.11.0.
Affected products
- rolandd.com RO CSVI extension for Joomla 1.0.0 to 9.10.x (fixed in 9.11.0)
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory