Joomla! CMS CVE-2026-48950

Q: What is the CVSS score of CVE-2026-48950?

CVE-2026-48950 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42067 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-07 Joomla

GHSA-f8m6-4q3w-326j

XSS Joomla Cms Joomla Project

5.9

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory admin-level access to com_templates; S:C and UI:R capture XSS executing in a victim admin's browser context; no availability impact applies.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 19:02 vuln.today

DescriptionCVE.org

Lack of escaping leads to an XSS vulnerability in the file management view of com_templates.

AnalysisAI

Cross-site scripting in Joomla! CMS com_templates file management view allows a high-privileged attacker to inject unescaped malicious script that executes in the browser of any administrator who subsequently views the affected template file listing. Affected versions span Joomla! 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1. No public exploit identified at time of analysis and the CVSS 4.0 supplemental metric E:U confirms no known active exploitation, but the wide install base and admin-targeting nature of the payload make this relevant to Joomla site operators.

Technical ContextAI

The vulnerability resides in com_templates, the Joomla! CMS core component responsible for template and theme file management within the administrator back-end. CWE-79 (Improper Neutralization of Input During Web Page Generation) confirms the root cause: user-controlled input - likely a filename, directory name, or file content rendered in the file manager view - is reflected or stored and subsequently output into HTML without adequate entity encoding or escaping. When the vulnerable view is rendered, the browser interprets the injected payload as live script. The CPE string cpe:2.3:a:joomla!_project:joomla!_cms identifies the Joomla! CMS application as the affected software across all platforms for versions in the 4.x-5.x and 6.x branches.

RemediationAI

The primary remediation is to upgrade Joomla! CMS to a version beyond the affected ranges (above 5.4.6 for the 5.x series, or above 6.1.1 for the 6.x series) once vendor-released patched versions are published; consult https://developer.joomla.org/security-centre/1058-20260704-core-xss-in-com-templates.html for exact fixed version numbers as the input data does not confirm a specific patch release version. As a compensating control, restrict access to the Templates component (com_templates) to only the minimum set of trusted administrators using Joomla's ACL system - this reduces the pool of accounts that could plant or trigger the payload. Additionally, review the Content Security Policy (CSP) headers of your Joomla installation; a restrictive CSP that blocks inline scripts can limit the impact of XSS execution even if the vulnerability is triggered. No workaround eliminates the underlying lack of escaping without a code fix.