[20260810] - Core - Unrestricted uploads of SHTML files
Joomla fixed CVE-2026-73373, an unrestricted SHTML file upload flaw affecting CMS 1.0.0-5.4.7 and 6.0.0-6.1.2 that can enable code execution.
Joomla published security advisory 20260810 for CVE-2026-73373, an unrestricted upload of files with dangerous type in Joomla CMS. The default dangerous-file list omitted SHTML files, which could lead to code execution on servers that execute SHTML. Affected versions are 1.0.0-5.4.7 and 6.0.0-6.1.2; fixes ship in 5.4.8 and 6.1.3. The issue was reported by Valentin Lobstein (Chocapikk) on 2026-07-29.
- Default dangerous-file list omitted SHTML files
- Could allow code execution on servers that execute SHTML
- Fixed in Joomla CMS 5.4.8 and 6.1.3
- Reported by Valentin Lobstein (Chocapikk) on 2026-07-29
- CVEs
- CVE-2026-73373
- Vendors
- Joomla
- Products
- Joomla CMS
- Organizations
- Joomla
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73373 | Unrestricted SHTML upload leading to server code execution in Joomla CMS | 8.9 | <1% |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: Low Probability: Low Versions: 1. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.