Joomla CMS CVE-2026-48954

Exploitation requires the attacker to hold a high-privileged Joomla account (PR:H) - an administrator or super-administrator role with write access to the language override management panel in the Joomla back-end. Additionally, a victim must passively load a page (UI:P) that renders the maliciously crafted language string, whether in the administrative back-end or a front-end template. The vulnerability is NOT exploitable by unauthenticated users or low-privileged subscribers and editors who lack back-end language override write access. Limiting factors include: the high privilege barrier to write payloads, the requirement for victim page rendering to trigger execution, and the absence of any cross-system scope change (SC:N). Organizations where all administrator accounts are tightly controlled and monitored face substantially lower realistic risk than multi-admin or shared-hosting Joomla environments.

The CVSS 4.0 score of 5.9 (Medium) accurately reflects the PR:H requirement, which meaningfully constrains exploitability: an attacker must already control a high-privileged Joomla account - typically a super-administrator or administrator with back-end access - before the vulnerability can be triggered. Despite VC:H and VI:H ratings on the vulnerable system, this prerequisite substantially limits real-world risk compared to an unauthenticated or low-privilege vector. The UI:P metric signals that a victim must passively load a page rendering the poisoned language string, introducing an additional dependency on victim behavior. The E:U metric and absence from the CISA KEV catalog confirm no known active exploitation at time of analysis. No EPSS score was provided in the input, so probability of exploitation within 30 days cannot be quantified. The primary threat model is a malicious insider administrator, a compromised administrator account, or a multi-tenant CMS deployment where a lower-tier admin can write language overrides but cannot otherwise escalate. This is not a fire-drill priority for most organizations but warrants patching on the normal monthly cycle, particularly for shared or multi-admin Joomla installations.

A malicious or compromised Joomla administrator logs into the back-end and navigates to the language override manager, injecting a JavaScript payload (e.g., a script that exfiltrates document.cookie to an attacker-controlled server) into a frequently rendered language string. When another administrator or an authenticated front-end user visits a page that renders the poisoned string, the script executes silently in their browser, enabling session hijacking or account takeover. No public exploit code has been identified at time of analysis.