Joomla! CMS CVE-2026-48953

Q: What is the CVSS score of CVE-2026-48953?

CVE-2026-48953 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42062 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-07 Joomla

GHSA-xq54-fg9w-jw52

XSS Joomla Cms Joomla Project

5.9

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory admin-level access to inject payload; UI:R for victim page-view; S:C for browser-context scope change; C:L/I:L for session theft and page tampering limited to browser scope.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 18:59 vuln.today

DescriptionCVE.org

Lack of escaping leads to an XSS vulnerability in the generic image output layout.

AnalysisAI

Cross-site scripting in Joomla! CMS's generic image output layout enables a high-privileged attacker to inject malicious script payloads that execute in the browsers of other authenticated users who view the affected content. The root cause is absent HTML output escaping in the image rendering component (CWE-79), allowing injected JavaScript to break out of the intended data context. No public exploit has been identified at time of analysis, and exploitation requires a pre-existing high-privileged Joomla account plus passive victim interaction, substantially limiting real-world exposure despite high impact scores on confidentiality and integrity.

Technical ContextAI

Joomla! CMS (CPE: cpe:2.3:a:joomla!_project:joomla!_cms:*:*:*:*:*:*:*:*) is a widely deployed open-source PHP content management system. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), which occurs when user-controlled or database-sourced values are echoed into HTML output without proper entity encoding (e.g., converting < to < and & to &). In this instance, the defect resides specifically in the generic image output layout component - a rendering layer responsible for displaying image-related content. Failure to escape output at this layer allows script payloads stored or passed through image metadata or layout parameters to execute in the browser context of any user who views the rendered output. This is a classic stored or reflected XSS pattern depending on where the unescaped value originates.

RemediationAI

Apply the Joomla! security update addressing CVE-2026-48953 as documented by the Joomla Security Centre at https://developer.joomla.org/security-centre/1061-20260707-core-xss-in-the-generic-image-output-layout.html. A specific fixed version number was not confirmed in the available intelligence - consult the advisory directly to identify the minimum safe Joomla release before upgrading. As a compensating control pending patch application, reduce the number of accounts assigned Super Administrator and Administrator roles to an absolute minimum, as these are the only roles that can inject payloads into the affected image layout; removing unnecessary privileged accounts eliminates the injection vector. Implementing a restrictive Content Security Policy header (e.g., script-src 'self') on the Joomla installation can significantly reduce XSS impact by blocking inline script execution, though administrators should test CSP compatibility with installed extensions before deploying to production, as Joomla extensions frequently rely on inline scripts.