Joomla! CMS CVE-2026-35221

Exploitation requires an authenticated Joomla! session with high-level administrative privileges, confirmed by both the CVSS 4.0 PR:H designation and the vendor advisory title ('authenticated blind SQLi in com_finder'). The attacker must have access to the com_finder Smart Search component interface within the administrator panel. The blind injection nature - requiring iterative boolean or time-based inference queries - is consistent with SSVC's 'Automatable: no' determination, ruling out scripted mass exploitation. Exploitation is further limited by: (1) mandatory high-privilege authentication, making this dependent on a compromised admin account or malicious insider; (2) impact confined strictly to confidentiality - no database write access or service disruption is achievable per CVSS (VI:N/VA:N); (3) the blind technique requiring significant dwell time and attacker interaction. Affected versions are specifically 5.4.0-5.4.5 and 6.0.0-6.1.0; other versions are not confirmed vulnerable based on available data.

The CVSS 4.0 base score of 6.9 (Medium) reflects a network-reachable attack surface and high confidentiality impact, but is meaningfully constrained by the requirement for high-privilege authentication (PR:H) and the absence of integrity or availability impact (VI:N/VA:N). EPSS at 0.03% - 8th percentile - corroborates very low observed exploitation probability. SSVC independently classifies exploitation as none, the attack as non-automatable, and technical impact as partial, all of which align with the high-auth barrier and the iterative nature of blind injection. This vulnerability is not listed in the CISA KEV catalog and no public POC has been identified. Real-world risk is primarily concentrated in scenarios involving compromised administrator credentials or insider threats; opportunistic mass exploitation is implausible given the authentication requirement and blind technique complexity. No conflicting signals exist in the available data: CVSS, EPSS, and SSVC all consistently indicate a lower-urgency finding relative to the raw score.

An attacker who has obtained high-privilege Joomla! administrator credentials - whether through phishing, credential stuffing, or insider access - logs into the admin panel and submits crafted filter parameters to the com_finder Smart Search interface. Through repeated boolean-condition or time-delay SQL injection queries, the attacker systematically extracts sensitive database contents such as user password hashes, email addresses, API tokens, or other confidential CMS data. No public exploit code has been identified at time of analysis, and the blind injection technique requires significant attacker skill and patience.