EUVD-2026-17857Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the absence of a CVSS score and vector, the risk is significant: (1) CWE-79 XSS vulnerabilities in web applications are consistently exploitable; (2) the attack vector is network-based with no apparent authentication requirement for accessing the associations comparison view; (3) XSS in a CMS component can compromise site administrators and visitors alike; (4) Joomla is a widely deployed platform with millions of active installations, making this a high-impact vulnerability; (5) no public exploit code availability is documented, but the low technical complexity of XSS attacks means weaponization is trivial. The absence of CVSS data prevents quantified severity comparison, but the scope and accessibility suggest this warrants immediate remediation across all affected versions. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing JavaScript payloads injected into multilingual association parameters and sends it to a Joomla site administrator or content editor. When the victim clicks the link or is redirected to it, the unescaped payload executes in their browser with administrator privileges, allowing the attacker to steal session cookies, modify site content, or create backdoor accounts. Since this is a CMS component likely accessed by authorized users, the attack surface includes internal administrative workflows and potentially users with edit permissions to multilingual content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Cross-site scripting (XSS) in Joomla CMS multilingual associations component allows unauthenticated remote attackers to inject malicious scripts via unescaped output in the comparison view. The vulnerability affects all versions of Joomla CMS and stems from improper output encoding in the com_associations component. No CVSS score is available; however, the CWE-79 classification confirms reflected or stored XSS capability.
RemediationAI
Apply the security patch released by Joomla Project as documented in their security advisory at https://developer.joomla.org/security-centre/1029-20260303-core-xss-vector-in-com-associations-comparison-view.html. The patch addresses output escaping in the com_associations comparison view to prevent XSS injection. If a patched version is not immediately available, disable or restrict access to the multilingual associations component through administrator control panel access controls or web server rules until the patch can be deployed. Ensure all Joomla installations are kept current with security updates and consider implementing Content Security Policy (CSP) headers as a defense-in-depth measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Joomla CMS's multilingual associations component (com_associations), specifically in the comparison view functionality. CWE-79 identifies the root cause as improper neutralization of input during web page generation, meaning user-controlled data is rendered in HTML/JavaScript context without adequate escaping or encoding. The Joomla framework provides output escaping functions (e.g., HTMLspecialchars, JSON encoding) that should have been applied to multilingual association data before rendering to the browser. The absence of these protections allows attackers to inject arbitrary HTML and JavaScript that executes in the victim's browser session, potentially enabling credential theft, session hijacking, or malware distribution.
Know when Joomla Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
DescriptionCVE.org
Lack of output escaping leads to a XSS vector in the multilingual associations component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in CMS Security Vulnerabilities
View all 6More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-priv
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
MFA bypass in Joomla! CMS 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 allows an attacker who can drive the login flow to
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Exploit-DB