# CVE-2026-88855: OrdaSoft Joomla Gallery SQL injection

Source: https://junglewise.ai/threats/cve-2026-88855-joomla-extension-ordasoft-com-authenticated-privileged-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88855 · Severity: info · Published 2026-09-20

OrdaSoft Joomla Gallery is a component for managing image galleries within Joomla websites. An authenticated user with gallery management permissions can inject SQL commands through unsanitized form fields, allowing them to read and modify database contents including user credentials and password hashes. This requires the attacker to already have legitimate gallery management access, significantly limiting the attack surface.

Technologies: [OrdaSoft Joomla Gallery](https://junglewise.ai/threats/technologies/joomla-gallery). Vendors: [OrdaSoft](https://junglewise.ai/threats/vendors/ordasoft).

## Quick answers

**Is CVE-2026-88855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88855 being exploited in the wild.

**How severe is CVE-2026-88855?** Informational severity, published 20 September 2026.

**Which products and versions are affected?** OrdaSoft Joomla Gallery < 6.2.7.

**Is there a fix for CVE-2026-88855?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88855 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88855?** Check whether you run OrdaSoft Joomla Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The saveGallery() method in the extension parses form input and passes values from category_names[], catOrderIds, and image-ordering fields directly into SQL queries without quoting or type casting. An authenticated user with core.manage permission on the gallery component can exploit this via UNION-based SQL injection to extract sensitive data. The vulnerability requires prior authentication and scoped gallery management privileges, not administrator-level access.

## Affected products

- OrdaSoft Joomla Gallery < 6.2.7

## Timeline

- 2026-09-20: disclosed

## References

- [https://www.ordasoft.com/](https://www.ordasoft.com/)

## Related threats

- [OrdaSoft Joomla Gallery arbitrary file upload and code execution](https://junglewise.ai/threats/cve-2026-88857-joomla-extension-ordasoft-com-authenticated-privileged-remote)
- [OrdaSoft Joomla Gallery authenticated remote code execution](https://junglewise.ai/threats/cve-2026-88856-joomla-extension-ordasoft-com-authenticated-privileged-remote)
- [OrdaSoft Joomla Gallery SQL injection in search module](https://junglewise.ai/threats/cve-2026-88854-joomla-extension-ordasoft-com-unauthenticated-sql-injection-in)