CVE-2026-92224

Joomla! core does not properly escape inputs in the link toolbar layout, creating a cross-site scripting flaw (CWE-79). An attacker who already has high privileges can place malicious input that the layout renders unsafely; a victim must then view or otherwise interact with that layout for the script to run in their browser. In the victim’s session this can disclose or change site data (high confidentiality and integrity impact, low availability impact) without affecting other systems. Every site running Joomla 4.0.0–5.4.8 or 6.0.0–6.1.3 is in scope. No public proof of concept is known, exploitation is unreported in the CVSS data, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog.

What to do: Upgrade Joomla! to a vendor-patched release outside the affected ranges (later than 5.4.8 on the 4.x/5.x line, or later than 6.1.3 on the 6.x line) as published by the Joomla security team. Until that update is applied, limit high-privilege accounts that can edit link-toolbar content and avoid opening untrusted toolbar layouts in an authenticated session. After patching, review recent link-toolbar content for injected markup.