Joomla! CMS CVE-2026-48952

Q: What is the CVSS score of CVE-2026-48952?

CVE-2026-48952 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42070 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-07 Joomla

GHSA-h46f-m4f9-8xcq

XSS Joomla Cms Joomla Project

5.9

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Network-delivered XSS requires admin authentication (PR:H) and user interaction (UI:R); scope changes to victim browser context (S:C) with limited C/I impact from session exposure.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 19:00 vuln.today

DescriptionCVE.org

Lack of escaping leads to an XSS vulnerability in the update list view of com_installer.

AnalysisAI

Cross-site scripting in Joomla! CMS's com_installer component exposes the administrator backend to script injection via the update list view, stemming from missing output escaping (CWE-79). The CVSS 4.0 vector (PR:H/UI:P/E:U) confirms exploitation is constrained to sessions where a high-privilege administrator views the maliciously influenced update list, substantially limiting the attack surface. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerable component is com_installer, Joomla!'s built-in extension and update management subsystem accessible only from the administrator backend. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: data rendered in the update list view is not properly HTML-escaped before output, allowing attacker-controlled strings to be interpreted as JavaScript by the victim's browser. The CPE cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:* spans the full Joomla! CMS product line without bounding a specific version range, suggesting the flaw may affect multiple release branches. The CVSS 4.0 supplemental metric E:U (Exploitation Unlikely) aligns with the admin-only, interaction-dependent attack surface.

RemediationAI

Consult the Joomla security advisory at https://developer.joomla.org/security-centre/1060-20260706-core-xss-in-com-installer.html for the exact patched release version and apply the vendor-released update; a specific fixed version number is not confirmed from the available input data and should not be assumed. As a compensating control pending patching, restrict access to the Joomla administrator backend (/administrator) to trusted IP ranges via web server or firewall rules - this directly blocks the network delivery phase without disrupting front-end functionality. Additionally, audit and enforce the principle of least privilege on Joomla user accounts, ensuring no untrusted or compromised accounts hold Super User or Administrator roles, since PR:H is a hard prerequisite for exploitation. Disabling the Update component in Joomla's global configuration is another option but will prevent administrators from receiving update notifications, introducing an operational trade-off.