Joomla! CMS CVE-2026-48950

Exploitation requires the attacker to hold a Joomla administrator account with access to the Templates manager (com_templates), which is a non-default privilege granted only to users in the Administrator or Super User groups. The XSS fires passively when any administrator with access to the same component loads the file management view, satisfying the UI:P (passive interaction) condition. Exploitation is limited to environments where multiple administrator accounts exist or where the compromising attacker wishes to escalate within the admin session itself. The vulnerability does not affect unauthenticated users or lower-privileged editors/authors. Non-admin Joomla deployments with a single administrator account face reduced risk, as the attacker would need to be the same person planting and triggering the payload.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L) reveals a nuanced risk profile. The high privilege requirement (PR:H) is a meaningful barrier: an attacker must already hold administrator-level access to reach the template file manager, substantially limiting the attack surface to insider threats, compromised admin accounts, or post-authentication pivot scenarios. Despite AC:L and AV:N suggesting low complexity once access is obtained, the practical exploitation chain requires chaining administrative access with social or passive triggering of another administrator's session (UI:P). The impact metrics VC:H/VI:H reflect that successful XSS execution in an admin's browser context can yield full session hijacking, credential theft, or administrative action on behalf of the victim. The E:U supplemental metric and absence from CISA KEV confirm no exploits in the wild at time of analysis, making this a low-urgency but legitimate patching priority for Joomla installations with multiple administrator accounts.

An attacker with Joomla administrator credentials navigates to the Templates file management view and crafts or uploads a resource (such as a file or directory) whose name contains an unsanitized XSS payload. When a second administrator - or the same attacker targeting their own session for demonstration - loads the file management view, the unescaped payload executes in the browser, allowing the attacker to steal the active session token and assume full administrative control of the Joomla site. No public exploit code has been identified at time of analysis.