Joomla CMS CVE-2026-90918

Requires the HTML mail template feature of Joomla core to be in use and attacker-influenced data to reach a template field that is emitted without escaping, then a victim to render the resulting HTML email in a script-executing context (browser-based preview/webmail). Limiting factors: mail-template configuration is an administrative/operator function; many email clients sanitize or strip inline script, reducing the reliability of delivery; the vendor's PR:N/UI:N rating likely overstates reachability since a rendering victim is needed. Affects Joomla 4.0.0-5.4.8 and 6.0.0-6.1.3 only.

This is a stored/reflected XSS (CWE-79) in Joomla's HTML mail template feature, self-reported by Joomla in advisory 20260908. The vendor CVSS 4.0 vector (6.9, AV:N/AC:L/PR:N/UI:N/VC:L/VI:N/VA:N) implies unauthenticated, no-interaction network exploitation against confidentiality only, but this rating is internally inconsistent for a mail-template XSS: rendering an injected payload realistically requires a victim to open/preview the message (UI should be Required) and configuring mail templates is an administrative function, so PR:N/UI:N appears overstated - verify with the vendor advisory. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so despite Joomla's ubiquity this is not evidence of active or imminent widespread exploitation. Net real-world risk is moderate: broad install base and a mail feature present in many extensions, but constrained by the need for a rendering context (email clients frequently strip active script) and likely privileged injection points, making it a real-but-not-urgent patch item rather than a drop-everything emergency.

An attacker gets attacker-controlled data (e.g., values later interpolated into an HTML mail template across one of the affected core extensions) into the mail pipeline without proper escaping. When the resulting HTML email is rendered in a browser-based mail preview or webmail context, the injected script executes in the viewer's session, enabling session-token theft or actions in the victim's authenticated context. No public proof-of-concept exists at time of analysis.