Unrestricted SHTML upload leading to server code execution in Joomla CMS
Joomla CMS's default upload filter omitted SHTML files from its list of dangerous file types, allowing users with upload privileges (typically administrator-level, per the privileged-requirement metric in the CVSS 4.0 vector) to place .shtml files on the server. On web servers configured to execute SHTML files (e.g., Apache with server-side includes enabled), an uploaded .shtml file is executed when accessed, giving the attacker server-side code execution on the host. The high subsequent-system impact ratings in the CVSS 4.0 score indicate the compromise can extend beyond the web application itself depending on server configuration. Affected versions span essentially Joomla's entire history: 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, so virtually every current Joomla installation is in scope, though only hosts that actually execute .shtml are exposed to code execution. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days (29th percentile) and the flaw is not on the CISA KEV list.
· Joomla! (all lines through 5.x) 1.0.0 - 5.4.7 · Joomla! (6.x line) 6.0.0 - 6.1.2mass
Inconsistent ACL checks in Joomla! webservice API allow unauthorized mutations
CVE-2026-71574 is an improper access control flaw (CWE-284) in the Joomla! CMS core, affecting versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, in which the webservice (REST API) endpoints enforce weaker ACL checks than the backend administration UI. An attacker holding credentials for an account with API access can send create, update, or delete requests to webservice endpoints and have them succeed even though the same mutations would be denied for that account in the backend; the CVSS 4.0 vector scores it as network-exploitable, low complexity, requiring high-privileged credentials and no user interaction. The impact is unauthorized modification of site data through the API without the required permissions, with the CVSS vector rating high impact to confidentiality and integrity and no availability impact. Any Joomla installation on the affected versions with the webservice plugins enabled and API users configured is exposed. No public proof-of-concept, no CISA KEV listing, and a low EPSS score of 0.2% indicate exploitation has not yet been observed.
· Joomla! CMS (core) 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2mass
MFA/2FA Authentication Bypass in Joomla CMS Core
Joomla! core versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 contain an improper-authentication flaw (CWE-287) in which insufficient state checks allow the multi-factor authentication (MFA/2FA) step of login to be bypassed. The CVSS 4.0 vector's attack-requirement metric (AT:P) indicates a present precondition is needed — effectively that MFA is configured on the targeted account or site — while no privileges or user interaction are required. A successful bypass grants the attacker authenticated access without completing the second factor, with the scored impact being high on integrity (CVSS 4.0 score 8.2, High). Any site running Joomla within the affected ranges is affected, which effectively covers all current Joomla 4.x, 5.x and 6.x installs, though only those with MFA in use are exposed to the bypass. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS assigns a 0.3% 30-day exploitation probability, so no exploitation is known as of the 2026-08-07 advisory.
· Joomla! CMS (core) 4.0.0 through 5.4.7 inclusive · Joomla! CMS (core) 6.0.0 through 6.1.2 inclusivemass
Unauthenticated CORS origin validation bypass in Joomla! Core 4.x–6.x
Joomla! Core fails to properly validate the origins configured as allowed for cross-origin (CORS) requests, so CORS requests coming from origins that are not on the site's allow-list are accepted as valid. It is triggered whenever a browser sends a CORS request to an affected Joomla site that has CORS origins configured; because the origin check is broken, a page on an attacker-controlled origin can have a visitor's browser issue cross-origin requests to the Joomla site and have the responses treated as readable in the visitor's session context. What the attacker gains is limited but real cross-origin access — the ability to read or interact with responses from affected endpoints using the visitor's credentials — which the CVSS 4.0 score (6.9, Medium, low impact on the subsequent system) reflects. Anyone running Joomla 4.0.0 through 5.4.7 or 6.0.0 through 6.1.2 is within the affected ranges, although only sites where administrators have actually configured CORS origins are practically exposed. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.2% probability of exploitation in the next 30 days, so no exploitation is currently known.
· Joomla! (Core) 4.0.0 – 5.4.7 · Joomla! (Core) 6.0.0 – 6.1.2mass
Improper ACL check leaks restricted contact data via schema.org in Joomla! Core
Joomla! Core 5.1.0 through 5.4.7 and 6.0.0 through 6.1.2 contain an improper access-control check (CWE-284) in the code that injects schema.org contact data into pages. When such a page is generated, the flawed check pulls in contact information from contact items the viewer is not authorized to see, embedding it in the schema.org snippet served to visitors. An attacker gains disclosure of contact details that should have been restricted; the CVSS 4.0 score of 5.1 (medium) reflects this low-confidentiality, network-exploitable issue with no impact on integrity or availability. Sites running the affected Joomla branches that render schema.org contact data are exposed, while installations on other versions or not using this feature are not. No public proof-of-concept exists, the issue is not in CISA's KEV catalog, and EPSS estimates a 0.2% probability of exploitation within 30 days, so no exploitation is currently known.
· Joomla! Core 5.1.0 - 5.4.7 · Joomla! Core 6.0.0 - 6.1.2mass
Stored XSS via schema.org markup output in Joomla! core 5.1.0–5.4.7 and 6.0.0–6.1.2
Joomla! core contains a cross-site scripting flaw (CWE-79) in which improperly set escaping flags allow malicious markup to pass unescaped into the schema.org structured-data output that the CMS renders on pages. An attacker who already holds elevated privileges on the site (the CVSS 4.0 vector requires high privileges, PR:H) can plant content or fields that the schema.org emitter then outputs without escaping, so attacker-supplied JavaScript executes in the browsers of anyone loading the affected pages, with no additional user interaction required. The practical gain is script execution in victims' session contexts, though the 5.1 medium CVSS 4.0 score indicates low-impact confidentiality and integrity effects rather than full system compromise. All sites running Joomla! 5.1.0 through 5.4.7 or 6.0.0 through 6.1.2 are affected. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and EPSS estimates only about a 0.2% chance of exploitation in the next 30 days, so no exploitation is currently known.
· Joomla! CMS 5.1.0 – 5.4.7 · Joomla! CMS 6.0.0 – 6.1.2mass
Improper ACL check enables unauthorized batch copy in Joomla! core
CVE-2026-73371 is an improper access-control (ACL) check in Joomla! core, affecting Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. When a user launches a batch operation, the code fails to correctly verify edit permissions on the targeted items, allowing batch copy actions on items the user is not permitted to edit. An attacker must already hold a relatively high-privileged account (CVSS 4.0 rates privileges required as high) and gains only limited impact: they can duplicate otherwise uneditable, potentially restricted content (low confidentiality impact, with no integrity or availability impact). Every Joomla site running any supported 4.x, 5.x (up to 5.4.7) or 6.x (up to 6.1.2) release is affected. There is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.2%, so no exploitation is currently known.
· Joomla! (core) 4.0.0 - 5.4.7 · Joomla! (core) 6.0.0 - 6.1.2mass
Improper ACL checks in Joomla! core custom fields web service endpoints
CVE-2026-72531 is an improper access control flaw (CWE-284) in the Joomla! CMS core, affecting the custom fields REST API (web service) endpoints. It is triggered when an authenticated, privileged user sends requests to these network-accessible API endpoints for a component they do not have permission to access, bypassing the ACL checks. The attacker can create custom fields on components that should be off-limits to them, a low-severity confidentiality and integrity issue scored 5.1 (medium) under CVSS 4.0. Any site running Joomla 4.0.0 through 5.4.7 or 6.0.0 through 6.1.2 is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.2%, so no exploitation is currently known.
· Joomla! CMS 4.0.0 through 5.4.7 · Joomla! CMS 6.0.0 through 6.1.2mass
Improper ACL checks in Joomla! category webservice endpoints
CVE-2026-72532 is an improper access control (ACL) check in Joomla! Core's webservice (API) endpoints for categories, affecting Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2. An authenticated API user whose account lacks permission to manage categories can send requests to the category webservice endpoints and create categories anyway; the CVSS vector indicates high required privileges and only low-severity confidentiality and integrity impact. An attacker gains the ability to insert unauthorized categories into the site's content structure, with no availability impact. Any Joomla 4.x, 5.x up to 5.4.7, or 6.x up to 6.1.2 installation is affected, though practical exploitation depends on the webservice API being enabled and reachable. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.2%, so no exploitation is currently known.
· Joomla! Core 4.0.0 through 5.4.7 · Joomla! Core 6.0.0 through 6.1.2mass
Response Header Injection in Joomla! Core Download Views (Reflected File Download)
CVE-2026-71572 is a response header injection (CWE-93, CRLF injection) in the download views of Joomla! core, caused by a lack of output processing of values written into HTTP response headers. An attacker who can influence header content and persuade a high-privileged user to trigger a download (the CVSS 4.0 vector requires high privileges and user interaction) can inject CRLF sequences, producing content-type confusion or a reflected file download in the victim's browser. The impact is limited to the integrity of the response delivered to the user (low impact on the subsequent system in CVSS 4.0); there is no confidentiality or availability impact on the server itself. All Joomla! sites running core versions 3.0.0-5.4.7 or 6.0.0-6.1.2 are affected. No public proof of concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.
· Joomla! (core CMS) 3.0.0 - 5.4.7 · Joomla! (core CMS) 6.0.0 - 6.1.2mass