Joomla! CMS CVE-2026-73373

Two concrete conditions must both be satisfied. First, the attacker must hold a Joomla account with sufficient privileges to upload files through the Joomla media manager or any component that delegates to the Framework Filesystem Package (typically Administrator role or a custom role with media upload permission); this is confirmed by CVSS PR:H. Second, the web server hosting Joomla must be configured to execute SHTML files via Server Side Includes - for Apache this requires Options +Includes and the SHTML MIME type mapping in the virtual host or .htaccess; for nginx it requires the ssi module with ssi on in the relevant location block - this is confirmed by AT:P in the CVSS 4.0 vector and the description phrase 'On servers that executed these files.' Exploitation is limited to: authenticated high-privilege users only (no anonymous vector), and hosting environments where SSI is explicitly enabled (non-default in virtually all modern managed hosting, shared hosting, and containerized deployments). The combination means the realistic at-risk population is a subset of Joomla sites running on self-managed servers where an admin has deliberately or inadvertently enabled SHTML processing.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H) captures the dual nature of this vulnerability: trivially exploitable once prerequisites are met, but gated behind two distinct requirements. PR:H confirms that a high-privilege account is needed to perform the upload, meaning unauthenticated or low-privilege attackers cannot exploit this directly. AT:P (Attack Target: Present) confirms that a specific non-default server configuration - SSI execution of SHTML files - must be in place; this substantially reduces the population of exploitable installations. The scope change (SC:H/SI:H/SA:H) reflects that successful exploitation breaks out of the Joomla application layer into the underlying OS process space. Real-world priority is moderate rather than critical: the high privilege requirement limits the attack surface to compromised admin accounts or insider threat scenarios, and SSI is rarely enabled in modern hosting environments where PHP or Node.js handle dynamic content. No KEV listing and no public exploit further support treating this as a medium-urgency patch rather than an emergency. The Joomla-reported source and presence of a formal advisory add confidence to the severity characterization, though the EPSS score is unavailable in the provided data.

An attacker with a high-privilege Joomla account (administrator or a custom role granted media upload rights) navigates to the Joomla media manager or a component that invokes the Framework Filesystem Package upload routine, uploads a crafted SHTML file containing SSI exec directives (e.g., <!--#exec cmd="id" -->), and then requests the uploaded file's URL. On a server with SSI enabled for the upload directory, the web server processes the directive and executes the embedded command as the web server process user, returning arbitrary command output or establishing a reverse shell. No public proof-of-concept code has been identified at time of analysis.