Unrestricted SHTML upload leading to server code execution in Joomla CMS
Joomla CMS's default upload filter omitted SHTML files from its list of dangerous file types, allowing users with upload privileges (typically administrator-level, per the privileged-requirement metric in the CVSS 4.0 vector) to place .shtml files on the server. On web servers configured to execute SHTML files (e.g., Apache with server-side includes enabled), an uploaded .shtml file is executed when accessed, giving the attacker server-side code execution on the host. The high subsequent-system impact ratings in the CVSS 4.0 score indicate the compromise can extend beyond the web application itself depending on server configuration. Affected versions span essentially Joomla's entire history: 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, so virtually every current Joomla installation is in scope, though only hosts that actually execute .shtml are exposed to code execution. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days (29th percentile) and the flaw is not on the CISA KEV list.
· Joomla! (all lines through 5.x) 1.0.0 - 5.4.7 · Joomla! (6.x line) 6.0.0 - 6.1.2mass
MFA/2FA Authentication Bypass in Joomla CMS Core
Joomla! core versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 contain an improper-authentication flaw (CWE-287) in which insufficient state checks allow the multi-factor authentication (MFA/2FA) step of login to be bypassed. The CVSS 4.0 vector's attack-requirement metric (AT:P) indicates a present precondition is needed — effectively that MFA is configured on the targeted account or site — while no privileges or user interaction are required. A successful bypass grants the attacker authenticated access without completing the second factor, with the scored impact being high on integrity (CVSS 4.0 score 8.2, High). Any site running Joomla within the affected ranges is affected, which effectively covers all current Joomla 4.x, 5.x and 6.x installs, though only those with MFA in use are exposed to the bypass. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS assigns a 0.3% 30-day exploitation probability, so no exploitation is known as of the 2026-08-07 advisory.
· Joomla! CMS (core) 4.0.0 through 5.4.7 inclusive · Joomla! CMS (core) 6.0.0 through 6.1.2 inclusivemass
Stored XSS via schema.org markup output in Joomla! core 5.1.0–5.4.7 and 6.0.0–6.1.2
Joomla! core contains a cross-site scripting flaw (CWE-79) in which improperly set escaping flags allow malicious markup to pass unescaped into the schema.org structured-data output that the CMS renders on pages. An attacker who already holds elevated privileges on the site (the CVSS 4.0 vector requires high privileges, PR:H) can plant content or fields that the schema.org emitter then outputs without escaping, so attacker-supplied JavaScript executes in the browsers of anyone loading the affected pages, with no additional user interaction required. The practical gain is script execution in victims' session contexts, though the 5.1 medium CVSS 4.0 score indicates low-impact confidentiality and integrity effects rather than full system compromise. All sites running Joomla! 5.1.0 through 5.4.7 or 6.0.0 through 6.1.2 are affected. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS estimates only about a 0.2% chance of exploitation in the next 30 days, so no exploitation is currently known.
· Joomla! CMS 5.1.0 – 5.4.7 · Joomla! CMS 6.0.0 – 6.1.2mass
Improper ACL check enables unauthorized batch copy in Joomla! core
CVE-2026-73371 is an improper access-control (ACL) check in Joomla! core, affecting Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. When a user launches a batch operation, the code fails to correctly verify edit permissions on the targeted items, allowing batch copy actions on items the user is not permitted to edit. An attacker must already hold a relatively high-privileged account (CVSS 4.0 rates privileges required as high) and gains only limited impact: they can duplicate otherwise uneditable, potentially restricted content (low confidentiality impact, with no integrity or availability impact). Every Joomla site running any supported 4.x, 5.x (up to 5.4.7) or 6.x (up to 6.1.2) release is affected. There is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.2%, so no exploitation is currently known.
· Joomla! (core) 4.0.0 - 5.4.7 · Joomla! (core) 6.0.0 - 6.1.2mass
Improper ACL check leaks restricted contact data via schema.org in Joomla! Core
Joomla! Core 5.1.0 through 5.4.7 and 6.0.0 through 6.1.2 contain an improper access-control check (CWE-284) in the code that injects schema.org contact data into pages. When such a page is generated, the flawed check pulls in contact information from contact items the viewer is not authorized to see, embedding it in the schema.org snippet served to visitors. An attacker gains disclosure of contact details that should have been restricted; the CVSS 4.0 score of 5.1 (medium) reflects this low-confidentiality, network-exploitable issue with no impact on integrity or availability. Sites running the affected Joomla branches that render schema.org contact data are exposed, while installations on other versions or not using this feature are not. No public proof-of-concept exists, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.2% probability of exploitation within 30 days, so no exploitation is currently known.
· Joomla! Core 5.1.0 - 5.4.7 · Joomla! Core 6.0.0 - 6.1.2mass