CVE-2026-90914

Joomla! Core does not escape output in its generic audio and video media layouts, which is a cross-site scripting flaw (CWE-79). An attacker who already has high privileges can supply content that is rendered unsafely when those layouts are displayed, so a victim who views the page can have script run in the browser. On the vulnerable site that yields high confidentiality and integrity impact and low availability impact; other systems are not affected. It applies to Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3, is reachable over the network with low complexity, and needs only passive user interaction. No public proof of concept is known, it is not on the CISA KEV list, and CVSS lists exploit maturity as unreported.

What to do: Install the Joomla security update for advisory [20260904] so sites are no longer on 4.0.0–5.4.8 or 6.0.0–6.1.3; do not assume a specific patch number beyond those ranges. Until updated, limit high-privilege accounts that can manage media and review audio and video items rendered by the generic media layouts for unexpected markup.