Is CVE-2026-66917 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66917 being exploited in the wild.

How severe is CVE-2026-66917?

Informational severity, published 22 August 2026.

Which products and versions are affected?

JoomGallery friends JoomGallery 4.0 to 4.3.x.

Is there a fix for CVE-2026-66917?

A patch was published on 2026-08-22: JoomGallery 4.4.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66917 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66917?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66917: JoomGallery stored XSS in image metadata

CVE-2026-66917 · Severity: info · Published 2026-08-22

JoomGallery is a popular image gallery extension for the Joomla content management system. A privileged authenticated user can inject malicious JavaScript code into image metadata, which is then executed in the browser of every website visitor viewing the gallery. This could lead to session hijacking, credential theft, or distribution of malware to all site visitors.

Quick answers

Is CVE-2026-66917 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66917 being exploited in the wild.
How severe is CVE-2026-66917?: Informational severity, published 22 August 2026.
Which products and versions are affected?: JoomGallery friends JoomGallery 4.0 to 4.3.x.
Is there a fix for CVE-2026-66917?: A patch was published on 2026-08-22: JoomGallery 4.4.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66917 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66917?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in JoomGallery versions prior to 4.4.0. An authenticated user with privileged access (likely administrator or gallery manager) can store a malicious XSS payload in image metadata fields without proper sanitization or encoding. The payload is then rendered unescaped in the gallery view, executing JavaScript in every visitor's browser without additional user interaction required. The vulnerability affects JoomGallery 4.x versions up to 4.3.x and was patched in version 4.4.0 (released 22 August 2026) and 4.4.2 (released 18 September 2026).

Affected products

JoomGallery friends JoomGallery 4.0 to 4.3.x

Timeline

2026-08-22: disclosed: CVE-2026-66917 published; JoomGallery 4.4.0 patched release
2026-08-22: patched: JoomGallery 4.4.0 released with fix
2026-09-18: patched: JoomGallery 4.4.2 security release addressing this and related issue

References

https://www.joomgalleryfriends.net/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.