EUVD-2026-50307
GHSA-qvc2-988f-wffq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable AJAX handler with no auth required (PR:N); reflected XSS requires victim interaction (UI:R); scope change (S:C) reflects browser context boundary crossing with low C and I impact.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
3DescriptionCVE.org
Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0
AnalysisAI
Cross-site scripting vulnerabilities in RO CSVI's AJAX endpoint handlers allow unauthenticated remote attackers to inject malicious scripts into the browsers of Joomla site users. All versions from 1.0.0 up to (but not including) 9.11.0 are affected. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS scope-changed vector (S:C) and absence of authentication requirement make this an accessible attack for opportunistic threat actors targeting Joomla deployments running the extension.
Technical ContextAI
RO CSVI is a third-party Joomla extension developed by rolandd.com that provides CSV import and export functionality for Joomla-based websites. The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) resides in the extension's AJAX endpoint handlers, which fail to properly sanitize or encode attacker-controlled input before reflecting or storing it in HTTP responses rendered by the victim's browser. The CVSS scope change (S:C) indicates that successful exploitation crosses a security boundary - typically from the Joomla application context into the victim's browser session, enabling theft of cookies, session tokens, or credential harvesting across browser origins. No CPE string was provided in the source data; the affected component is the RO CSVI Joomla extension (versions 1.0.0 through 9.10.x), as identified by the EUVD entry EUVD-2026-50307.
RemediationAI
The primary remediation is to upgrade RO CSVI to version 9.11.0 or later, which resolves the XSS vectors in the AJAX endpoint handlers. Extension updates can be applied through the Joomla administrator panel under Extensions > Manage > Update, or by downloading the patched package directly from https://rolandd.com/products/ro-csvi. If an immediate upgrade is not possible, a compensating control is to restrict access to the affected AJAX endpoints via web server configuration (e.g., blocking requests to the relevant Joomla component's AJAX routes using Apache mod_rewrite or nginx location blocks), though this may break legitimate CSV import/export functionality and should be tested before deployment. Additionally, enforcing a Content Security Policy (CSP) header on the Joomla installation can limit the impact of any XSS execution by restricting script sources, though this does not eliminate the underlying vulnerability. No side effects are expected from upgrading to 9.11.0 beyond the standard extension update process.
Cross-site request forgery in the RO CSVI (CSV Improved) import/export extension for Joomla by rolandd.com affects all v
Unauthenticated directory creation in the RO CSVI (CSV Improved) import/export extension for Joomla affects all versions
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today