EUVD-2026-42063
GHSA-g375-vm9h-5xvc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges required to inject payload; user interaction required for execution; scope changes to victim browser but impact is limited to session-level data.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components.
AnalysisAI
Cross-site scripting in Joomla! CMS modalreturn layout components enables a high-privileged attacker to inject and execute arbitrary JavaScript in a victim administrator's browser session. The root cause is insufficient output escaping in multiple component layouts that handle modal return values. No public exploit code has been identified and CISA KEV does not list this vulnerability; the CVSS 4.0 exploitation likelihood metric (E:U) further indicates no observed active exploitation at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled data rendered into HTML output without proper context-aware escaping. The affected surface is the 'modalreturn' layout pattern used across multiple Joomla! core components, which handle data returned from modal dialog interactions within the CMS administrative interface. Joomla! CMS is a PHP-based content management system (CPE: cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*). Modal return flows typically pass parameters between the modal popup and the parent window, and if these parameters are echoed into the DOM without HTML entity encoding or attribute-context escaping, attacker-controlled values become executable script. The breadth of affected components (described as 'various') suggests a systemic escaping pattern was overlooked across the codebase rather than an isolated single-component flaw.
RemediationAI
Apply the patch released by the Joomla! Project as described in security advisory 20260705 at https://developer.joomla.org/security-centre/1059-20260705-core-xss-in-various-modalreturn-layouts.html. The exact fixed version number is not independently confirmed from the available data - consult the advisory directly and upgrade to the minimum fixed release specified there. As an interim workaround where immediate upgrade is not possible, restrict backend (administrator) access to trusted IPs via web server or firewall rules, reducing the pool of users who could inject malicious payload. Additionally, enforce strict role separation so that only fully trusted users hold Joomla! super-administrator or editor privileges capable of interacting with affected components. Note that restricting IP access does not eliminate the flaw if a legitimate high-privilege user account is compromised; it only reduces attack surface.
More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today