[20260901] - Core - XSS in HTMLHelper::link method
Joomla HTMLHelper::link lacks output escaping, enabling XSS in CMS 1.5.0-6.1.3; patches are 5.4.9 and 6.1.4.
34
Vulnerability2 · 2 reads
CVE-2026-90906
XSS in Joomla core HTMLHelper::link method
- CVSS 4.0
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-90906 is a cross-site scripting flaw (CWE-79) in Joomla core: the HTMLHelper::link method does not escape output, so malicious markup can be placed in links the CMS generates. The published CVSS 4.0 vector (5.9 medium) rates it as network-reachable and low complexity, but it requires high privileges and only passive interaction by a victim who views the rendered page. A successful attack can run script in that browser session, with high impact on confidentiality and integrity of the site and low impact on availability; the score does not extend impact to other systems. Affected installations are Joomla 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. There is no known public proof of concept, the issue is not on the CISA KEV list, and CVSS exploit maturity is Unreported.
What to do: Install the Joomla core fix from security advisory 20260901 so the site is no longer on 1.5.0–5.4.8 or 6.0.0–6.1.3; use a currently supported patched release if the installed branch is no longer updated. Until that is done, restrict high-privilege accounts, since the vendor score requires them, and check rendered links for unexpected markup.
| Product | Affected |
|---|---|
| Joomla! CMS | 1.5.0 through 5.4.8 |
| Joomla! CMS | 6.0.0 through 6.1.3 |
Estimated exposure
massHundreds of thousands to roughly 1 million+ Joomla sites — Order-of-magnitude estimate from public web-technology surveys that have long counted Joomla in the hundreds of thousands to low millions of sites; this is a core flaw spanning nearly every version line in the advisory, so most of that…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.
- Vendors
- joomla
- Products
- joomla\!
- Ecosystems
- Joomla
- Weakness
- CWE-79
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X