[20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch
Joomla fixes an InputFilter XSS bypass from an HTML5 entity-decoding mismatch, CVE-2026-92231.
Joomla disclosed CVE-2026-92231, a moderate cross-site scripting issue in CMS InputFilter. The checkAttribute method normalized attribute values before testing them against the javascript: scheme, but did not decode HTML5 entities first, allowing a filter bypass. Versions 1.5.0–5.4.8 and 6.0.0–6.1.3 are affected. Reported by Netanel Stern, the flaw was fixed on 2026-09-25 in 5.4.9 and 6.1.4; exploitation is not described as ongoing.
- CVE-2026-92231 bypasses javascript: checks via HTML5 entities.
- Joomla rates impact moderate and exploitation probability low.
- Affects Joomla 1.5.0–5.4.8 and 6.0.0–6.1.3.
- Patched in Joomla 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-92231
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92231 | XSS filter bypass in Joomla Core InputFilter | 7.1 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1. 5.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.