CVE-2026-73373

Joomla CMS's default upload filter omitted SHTML files from its list of dangerous file types, allowing users with upload privileges (typically administrator-level, per the privileged-requirement metric in the CVSS 4.0 vector) to place .shtml files on the server. On web servers configured to execute SHTML files (e.g., Apache with server-side includes enabled), an uploaded .shtml file is executed when accessed, giving the attacker server-side code execution on the host. The high subsequent-system impact ratings in the CVSS 4.0 score indicate the compromise can extend beyond the web application itself depending on server configuration. Affected versions span essentially Joomla's entire history: 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, so virtually every current Joomla installation is in scope, though only hosts that actually execute .shtml are exposed to code execution. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days (29th percentile) and the flaw is not on the CISA KEV list.

What to do: Upgrade all Joomla sites to the first patched release after 5.4.7 (5.x line) and after 6.1.2 (6.x line) once available. Until then, restrict upload capability to trusted administrators and review media/upload directories for unexpected .shtml files. Also confirm whether your web server executes .shtml files (e.g., Apache with server-side includes enabled), since hosts that only store but never execute them carry little code-execution risk.