Joomla! Filter Package CVE-2026-48905

The CVSS 4.0 vector explicitly requires high privileges (PR:H), confirming the attacker must be authenticated as a Joomla! administrator or equivalent high-privileged account - unauthenticated remote exploitation is not possible. Additionally, passive user interaction (UI:P) is required, meaning a victim user must view or load the page containing the injected payload for the XSS to execute. The vulnerability is triggered specifically through the cleanattributes() HTML filter code path when processing attacker-supplied attribute values; deployments that do not pass user-controlled input through this code path are unaffected in practice. Exploitation is further limited to the Joomla! Framework Filter package versions 1.0.0-3.0.5 and 4.0.0-4.0.1. Per SSVC, the attack is not automatable, ruling out worm-like or scripted mass exploitation. The combination of required high privileges and required victim interaction represents two independent gates that must both be satisfied.

Multiple signals converge to indicate this is a lower operational priority despite the CVSS 4.0 base score of 6.9. The vector (PR:H/UI:P) requires a high-privileged, already-authenticated attacker and passive victim interaction - both are meaningful constraints that substantially shrink the realistic threat population. EPSS sits at 0.01% (0th percentile), reflecting near-zero historical exploitation signal. SSVC corroborates this: Exploitation is rated 'none,' Automatable is 'no,' and Technical Impact is 'partial.' The absence of a CISA KEV listing and no identified public exploit code further reinforce a low urgency posture. The one elevated signal is VC:H (high confidentiality impact on the vulnerable system), which models serious browser-side impact (e.g., session hijacking) if the XSS fires - but that outcome is gated behind the PR:H attacker prerequisite. In summary: this issue warrants patching in a normal release cycle but does not justify emergency response. Organizations with externally exposed Joomla! admin interfaces face marginally higher risk due to the reduced cost of obtaining high privileges via credential attacks.

An attacker who has obtained Joomla! administrator credentials - through phishing, credential stuffing, or account compromise - navigates to a content editing interface and submits HTML containing malicious attribute values that bypass the cleanattributes() filter. The crafted content is stored or delivered through the CMS to ordinary site visitors; when a victim's browser renders the page, the injected script executes, exfiltrating their session cookie or credentials to an attacker-controlled endpoint. No public exploit code has been identified at time of analysis, so an attacker would need to independently discover and craft a bypass for the filter.