Joomla vulnerabilities
We track 13 vulnerabilities in Joomla products. 12 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on September 29, 2026.
Latest Joomla vulnerabilities
- 7.5 High severity
Joomla! CMS: Improper Authentication
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.
- 8.0 High severity
Joomla! CMS: Server-Side Request Forgery
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors.
- 8.3 High severity
Joomla! CMS: Improper Neutralization of Input During Web Page Generation
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.
- 8.3 High severity
Joomla! CMS: Improper Neutralization of CRLF Sequences
Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests.
- 9.8 Critical severity
Joomla! CMS: Unrestricted Upload of File with Dangerous Type
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
- 7.5 High severity
Joomla! CMS: Improper Authentication
Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks.
- 7.3 High severity
Joomla! CMS: Improper Access Control
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
- 9.8 Critical severity
Joomla! Framework: Improper Neutralization of Special Elements used in an SQL Command
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and t
- 5.3 Medium severity
Joomla! Improper Access Control Exploited
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
- 9.8 Critical severity
Joomla! CMS: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.
- 9.8 Critical severity
Joomla! CMS: Improper Authentication
An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover.
- 7.5 High severity
Joomla! CMS: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.
- 9.8 Critical severity
PHPMailer Command Injection Exploited
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.