[20260901] - Core - XSS in HTMLHelper::link method
Joomla HTMLHelper::link lacks output escaping, enabling XSS in CMS 1.5.0-6.1.3; patches are 5.4.9 and 6.1.4.
Joomla disclosed CVE-2026-90906, a cross-site scripting flaw caused by missing escaping in the HTMLHelper::link method. The issue affects Joomla CMS 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. Joomla rates impact and severity as moderate and probability as low. Sites should upgrade to 5.4.9 or 6.1.4; the advisory does not report exploitation in the wild.
- CVE-2026-90906 is a cross-site scripting flaw in HTMLHelper::link.
- Missing output escaping in the link method can inject script.
- Affected builds are Joomla CMS 1.5.0-5.4.8 and 6.0.0-6.1.3.
- Joomla rates probability low and fixes it in 5.4.9 and 6.1.4.
- CVEs
- CVE-2026-90906
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla Security Strike Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90906 | XSS in Joomla core HTMLHelper::link method | 5.9 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1. 5.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.