AI analysis
Joomla CMS's default upload filter omitted SHTML files from its list of dangerous file types, allowing users with upload privileges (typically administrator-level, per the privileged-requirement metric in the CVSS 4.0 vector) to place .shtml files on the server. On web servers configured to execute SHTML files (e.g., Apache with server-side includes enabled), an uploaded .shtml file is executed when accessed, giving the attacker server-side code execution on the host. The high subsequent-system impact ratings in the CVSS 4.0 score indicate the compromise can extend beyond the web application itself depending on server configuration. Affected versions span essentially Joomla's entire history: 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, so virtually every current Joomla installation is in scope, though only hosts that actually execute .shtml are exposed to code execution. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days (29th percentile) and the flaw is not on the CISA KEV list.
What to do: Upgrade all Joomla sites to the first patched release after 5.4.7 (5.x line) and after 6.1.2 (6.x line) once available. Until then, restrict upload capability to trusted administrators and review media/upload directories for unexpected .shtml files. Also confirm whether your web server executes .shtml files (e.g., Apache with server-side includes enabled), since hosts that only store but never execute them carry little code-execution risk.
Affected
| Joomla! (all lines through 5.x) | 1.0.0 - 5.4.7 |
| Joomla! (6.x line) | 6.0.0 - 6.1.2 |
Estimated exposure
mass~1M+ active Joomla installations, with hundreds of thousands internet-exposed (every version since 1.0.0 is affected) — Public web-technology surveys and internet-wide scans consistently rank Joomla among the top open-source CMSs, counting hundreds of thousands of reachable Joomla sites and on the order of a million or more active installations, and the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.