# CVE-2026-76569: Phoca Download reflected XSS in search parameter

Source: https://junglewise.ai/threats/cve-2026-76569-phoca-download-reflected-xss-in-search-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76569 · Severity: info · Published 2026-08-20

Phoca Download is a Joomla extension for managing downloadable files and content. A reflected cross-site scripting (XSS) vulnerability in the search function allows attackers to inject malicious scripts that execute in users' browsers when they click a crafted link, potentially compromising user sessions or redirecting visitors to malicious sites.

Technologies: [Phoca.cz Phoca Download](https://junglewise.ai/threats/technologies/phoca-download). Vendors: [Phoca.cz](https://junglewise.ai/threats/vendors/phoca-cz).

## Quick answers

**Is CVE-2026-76569 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76569 being exploited in the wild.

**How severe is CVE-2026-76569?** Informational severity, published 20 August 2026.

**Which products and versions are affected?** Phoca.cz Phoca Download 5.0.0-6.1.4.

**Is there a fix for CVE-2026-76569?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76569 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76569?** Check whether you run Phoca.cz Phoca Download at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected XSS vulnerability exists in Phoca Download versions 5.0.0 through 6.1.4 in the search GET parameter. The vulnerability occurs because user-supplied input from the search parameter is not properly sanitized or encoded before being reflected in the HTTP response. An attacker can craft a malicious URL containing JavaScript code in the search parameter, and when a victim visits the link, the script executes in their browser with the context of the vulnerable application. No authentication is required, and the attack vector is network-based via a crafted URL. A patch is likely available in versions later than 6.1.4.

## Affected products

- phoca.cz Phoca Download 5.0.0-6.1.4

## Timeline

- 2026-08-20: disclosed

## References

- [https://www.phoca.cz/phocacart](https://www.phoca.cz/phocacart)

## Related threats

- [Phoca Download CSRF in category management](https://junglewise.ai/threats/cve-2026-102787-joomla-extension-phoca-cz-csrf-in-category-management-in-phoca)
- [Phoca Download for Joomla unrestricted file upload in member-upload feature](https://junglewise.ai/threats/cve-2026-57828-phoca-download-for-joomla-unrestricted-file-upload-in-member)