Joomla! CMS CVE-2026-48952

Exploitation requires that the attacker already hold or have compromised a Joomla account with high administrator privileges (PR:H per CVSS 4.0 vector) - standard contributor or registered user accounts are insufficient. Additionally, a legitimate administrator must actively load the com_installer update list view in their browser session (UI:P). The XSS trigger is specifically scoped to the update list view of com_installer and is not reachable from the front-end or by lower-privileged users. Exploitation is NOT possible without prior authenticated access at the administrator level and without victim interaction. These two hard prerequisites - high-privilege credential access AND admin user interaction - substantially constrain real-world exploitability beyond what the VC:H/VI:H impact metrics alone suggest.

The CVSS 4.0 base score of 5.9 with vector AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N reflects a meaningful but access-gated vulnerability. The high-privilege requirement (PR:H) and mandatory user interaction (UI:P) are the primary risk-reduction factors - an attacker must already control or compromise a Joomla administrator account and then induce that admin to load the update list view. The E:U supplemental metric confirms exploitation is assessed as unlikely. VC:H/VI:H suggests that once triggered, the XSS can achieve high confidentiality and integrity impact against the vulnerable system (e.g., full session takeover of the administrator panel). No EPSS score, KEV listing, or POC exploit was provided; exploitation probability cannot be independently quantified. In practice this is a medium-priority finding: high-severity if an admin session is hijacked, but the authentication prerequisite makes mass exploitation implausible.

An attacker who has obtained a high-privilege Joomla administrator account - through credential theft, phishing, or brute force - manipulates update-related data visible in the com_installer update list view to inject a malicious JavaScript payload. When a legitimate administrator next browses the update list, the unescaped payload executes in their browser, enabling session token theft or triggering unauthorized administrative actions on their behalf. No public exploit code has been identified at time of analysis.