[20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs
Joomla patches an InputFilter XSS bypass using whitespace in HTML data URIs, CVE-2026-92232.
Joomla’s security team disclosed CVE-2026-92232, a moderate cross-site scripting filter bypass in the CMS InputFilter. The cleanAttribute method is supposed to remove HTML data URIs, but injected whitespace can evade that cleanup. Affected releases are 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. Joomla fixed the issue in 5.4.9 and 6.1.4 on 2026-09-25; it rates exploitation probability as low, and no in-the-wild use is reported.
- CVE-2026-92232 is a moderate XSS bypass in InputFilter.
- Whitespace in HTML data URIs evades cleanAttribute filtering.
- Affects Joomla 1.5.0–5.4.8 and 6.0.0–6.1.3.
- Fixed in Joomla 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-92232
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92232 | XSS Filter Bypass in Joomla Core InputFilter | 7.1 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1. 5.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.