Joomla CMS

By the Year

In 2026 there have been 52 vulnerabilities in Joomla with an average score of 6.9 out of ten. Last year, in 2025 Joomla had 8 security vulnerabilities published. That is, 44 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.57.

Recent Joomla Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-71573	Aug 18, 2026	Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.	Joomla
CVE-2026-72531	Aug 18, 2026	Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components.	Joomla
CVE-2026-73336	Aug 18, 2026	Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7 Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs.	Joomla
CVE-2026-73372	Aug 18, 2026	Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets. Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets.	Joomla
CVE-2026-71572	Aug 18, 2026	Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.	Joomla
CVE-2026-73337	Aug 18, 2026	Joomla 4-5.4.7/6-6.1.2 MFA Bypass via Insufficient State Checks Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.	Joomla
CVE-2026-73371	Aug 18, 2026	Joomla! Core 4.0.0-5.4.7/6.0.0-6.1.2 Improper ACL batch copy Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items.	Joomla
CVE-2026-72532	Aug 18, 2026	Joomla! Core 4.0.0-5.4.7/6.0.0-6.1.2: Improper ACL on Category Webservice Joomla! Core - [20260806] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints.	Joomla
CVE-2026-73373	Aug 18, 2026	Joomla <6.1.2 - Unrestricted SHTML Upload (LFE) Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.	Joomla
CVE-2026-71574	Aug 18, 2026	Joomla! Core < 5.4.7 - Inconsistent ACL Checks on Webservice Mutation Endpoints Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.	Joomla
CVE-2026-73327	Aug 12, 2026	Joomla 6.1.1 com_joomlaupdate Path Traversal RCE	Joomla
CVE-2026-64792	Jul 22, 2026	Joomla Smart Search indexing flaw exposes privileged content Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrators identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.	Joomla
CVE-2026-48952	Jul 07, 2026	XSS via unescaped output in Joomla com_installer update list view Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.	Joomla
CVE-2026-48947	Jul 07, 2026	Joomla CMS Media File Overwrite via Improper Access Check An improper access check allows privileged users to overwrite media files without editing permissions.	Joomla
CVE-2026-48958	Jul 07, 2026	CVE-2026-48958: Unauthorized Custom Field Creation in Joomla Webservices An improper access check allows unauthorized users to create custom fields via webservices endpoints.	Joomla
CVE-2026-48950	Jul 07, 2026	XSS in Joomla com_templates File Manager View Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.	Joomla
CVE-2026-48955	Jul 07, 2026	CVE-2026-48955: Unauthorized Access to Joomla Workflow Stage & Transition Info An improper access check allows unauthorized users to access workflow stage and transition information.	Joomla
CVE-2026-48956	Jul 07, 2026	Joomla Module List Disclosure via Improper Access Check An improper access check allows users to display a list of modules in the frontend.	Joomla
CVE-2026-48957	Jul 07, 2026	Joomla! com_privacy Improper Access Control Bypass An improper access check allows unauthorized users to access com_privacy datasets.	Joomla
CVE-2026-48951	Jul 07, 2026	Joomla XSS via Unescaped Modalreturn Layouts Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.	Joomla
CVE-2026-48953	Jul 07, 2026	Joomla XSS via unescaped generic image output layout Lack of escaping leads to an XSS vulnerability in the generic image output layout.	Joomla
CVE-2026-48948	Jul 07, 2026	Joomla com_contact Improper Access Check Allows Private vCard Export An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.	Joomla
CVE-2026-48949	Jul 07, 2026	XSS in Joomla! MFA Management Views Lack of validation leads to an XSS vulnerability in the MFA management views.	Joomla
CVE-2026-48954	Jul 07, 2026	Joomla CMS XSS via Language Override Validation Flaw Improper validation leads to a generic XSS vector in the language override feature.	Joomla
CVE-2026-35221	May 26, 2026	Joomla com_finder SQLi via Improper Filter Clauses Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.	Joomla
CVE-2026-48903	May 26, 2026	XSS via inadequate content filtering in Joomla checkAttribute methods Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.	Joomla
CVE-2026-48896	May 26, 2026	Joomla 2FA Bypass via Insufficient State Checks Insufficient state checks lead to a vector that allows to bypass 2FA checks.	Joomla
CVE-2026-35220	May 26, 2026	Joomla CSRF Token Bypass in com_users Admin Activation Lack of CSRF token validation lead to a CSRF attack vector in the admin activation endpoint of com_users.	Joomla
CVE-2026-40383	May 26, 2026	Joomla LFI Vulnerability: Improper Input Validation An improper validation of user-supplied input leads to a local file inclusion vulnerability.	Joomla
CVE-2026-35222	May 26, 2026	Joomla com_tags SQL Injection via Order Clause Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.	Joomla
CVE-2026-40384	May 26, 2026	Joomla com_media Path Traversal via Unvalidated Search Parameter An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.	Joomla
CVE-2026-48905	May 26, 2026	XSS via lack of input filtering in Joomla HTML filter Lack of input filtering leads to an XSS vector in the HTML filter code.	Joomla
CVE-2026-48897	May 26, 2026	Joomla 2FA Bypass via Insufficient State Checks Insufficient state checks lead to a vector that allows to bypass 2FA checks.	Joomla
CVE-2026-25901	May 26, 2026	Joomla Multilingual Associations XSS from Unescaped Output Lack of output escaping leads to a XSS vector in the multilingual associations component.	Joomla
CVE-2026-48899	May 26, 2026	Privilege Escalation via Improper Access Check in Joomla com_users Batch Task An improper access check allows privilege escalation through the com_users batch task.	Joomla
CVE-2026-48900	May 26, 2026	Joomla! Improper Access Check Lets Low-Priv Users Edit Scheduler Task Types An improper access check allowed low privileged users to edit the task types of existing scheduler tasks.	Joomla
CVE-2026-48902	May 26, 2026	Joomla Auth Reset Generates Plain HTTP Links Without Force SSL The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.	Joomla
CVE-2026-35223	May 26, 2026	Joomla com_config Improper Access Check Exploits Webservice An improper access check allows unauthorized access to com_config webservice endpoints.	Joomla
CVE-2026-25900	May 26, 2026	Joomla Feed Module XSS via Unescaped Output Lack of output escaping leads to a XSS vector in the feed modules.	Joomla
CVE-2026-48904	May 26, 2026	Joomla com_users webservice privilege escalation (CVE-2026-48904) An improper access check allows privelege escalation through the com_users group editing webservice endpoint.	Joomla
CVE-2026-30895	May 26, 2026	Joomla com_content XSS via readmore links Lack of output escaping leads to a XSS vector in the readmore links for com_content.	Joomla
CVE-2026-48898	May 26, 2026	Joomla Improper Access Check in com_users Batch Task Enables Priv Esc An improper access check allows privilege escalation through the com_users batch task.	Joomla
CVE-2026-30894	May 26, 2026	Joomla XSS in Content History due to lack of output escaping Lack of output escaping leads to a XSS vector in the content history component.	Joomla
CVE-2026-48901	May 26, 2026	Joomla InputFilter Cache Key Bypass in Input Filtering The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.	Joomla
CVE-2026-21630	Apr 01, 2026	Joomla Articles Webservice SQLi via ORDER BY clause Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.	Joomla
CVE-2026-23898	Apr 01, 2026	Joomla CMS AutoUpd File Delete via Input Validation Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.	Joomla
CVE-2026-21629	Apr 01, 2026	Joomla AJAX Auth Bypass via Admin Check Exclusion The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.	Joomla
CVE-2026-23899	Apr 01, 2026	Joomla Improper Access Check Allows Unauthorized Webservice Access An improper access check allows unauthorized access to webservice endpoints.	Joomla
CVE-2026-21631	Apr 01, 2026	Joomla Multilingual Associations XSS via Unescaped Output Lack of output escaping leads to a XSS vector in the multilingual associations component.	Joomla
CVE-2026-21632	Apr 01, 2026	Joomla CMS XSS via unsanitized article titles Lack of output escaping for article titles leads to XSS vectors in various locations.	Joomla