[20260801] - Core - Response header injection in download views
Joomla fixes CVE-2026-71572, response header injection in download views enabling reflected file download attacks, in 5.4.8/6.1.3.
Joomla disclosed a response header injection flaw (CVE-2026-71572) in multiple download views, caused by lack of output processing, enabling reflected file download and content-type confusion. It is rated low impact, severity, and probability and affects Joomla CMS 3.0.0-5.4.7 and 6.0.0-6.1.2. The fix ships in Joomla 5.4.8 and 6.1.3 on 2026-08-18.
- CVE-2026-71572 enables response header injection in Joomla download views
- Leads to reflected file download and content-type confusion
- Affects Joomla CMS 3.0.0-5.4.7 and 6.0.0-6.1.2
- CVEs
- CVE-2026-71572
- Vendors
- Joomla
- Products
- Joomla CMS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71572 | Response Header Injection in Joomla! Core Download Views (Reflected File Download) | 4.8 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: Low Severity: Low Probability: Low Versions: 3. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.