CVE-2026-71572 is a vulnerability in Joomla
Published on August 18, 2026
Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.
Vulnerability Analysis
CVE-2026-71572 is exploitable with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a CRLF Injection Vulnerability?
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CVE-2026-71572 has been classified to as a CRLF Injection vulnerability or weakness.
Products Associated with CVE-2026-71572
Want to know whenever a new CVE is published for Joomla? stack.watch will email you.
Affected Versions
Joomla! Project Joomla! CMS:- Version 3.0.0-5.4.6 is affected.
- Version 6.0.0-6.1.2 is affected.