Executive brief
JoomGallery is a popular image gallery extension for the Joomla content management system. A privileged authenticated user can inject malicious JavaScript code into image metadata, which is then executed in the browser of every website visitor viewing the gallery. This could lead to session hijacking, credential theft, or distribution of malware to all site visitors.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in JoomGallery versions prior to 4.4.0. An authenticated user with privileged access (likely administrator or gallery manager) can store a malicious XSS payload in image metadata fields without proper sanitization or encoding. The payload is then rendered unescaped in the gallery view, executing JavaScript in every visitor's browser without additional user interaction required. The vulnerability affects JoomGallery 4.x versions up to 4.3.x and was patched in version 4.4.0 (released 22 August 2026) and 4.4.2 (released 18 September 2026).
Affected products
- JoomGallery friends JoomGallery 4.0 to 4.3.x
Timeline
- 2026-08-22: disclosed: CVE-2026-66917 published; JoomGallery 4.4.0 patched release
- 2026-08-22: patched: JoomGallery 4.4.0 released with fix
- 2026-09-18: patched: JoomGallery 4.4.2 security release addressing this and related issue