[20260801] - Core - Response header injection in download views

CVE-2026-71572 is a response header injection (CWE-93, CRLF injection) in the download views of Joomla! core, caused by a lack of output processing of values written into HTTP response headers. An attacker who can influence header content and persuade a high-privileged user to trigger a download (the CVSS 4.0 vector requires high privileges and user interaction) can inject CRLF sequences, producing content-type confusion or a reflected file download in the victim's browser. The impact is limited to the integrity of the response delivered to the user (low impact on the subsequent system in CVSS 4.0); there is no confidentiality or availability impact on the server itself. All Joomla! sites running core versions 3.0.0-5.4.7 or 6.0.0-6.1.2 are affected. No public proof of concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

Do: Upgrade Joomla! core to a release newer than 5.4.7 on the 5.x line or newer than 6.1.2 on the 6.x line, per the Joomla 20260801 core advisory, and verify the installed version in the admin panel afterwards. Because exploitation requires a high-privilege account and user interaction, also review administrator accounts for signs of compromise and limit admin access. No public PoC or in-the-wild exploitation is known, so treat this as a routine medium-priority patch.