Phoca Gallery EUVD-2026-109070

Exploitation requires the attacker to store a crafted HTML attribute payload through the Phoca Gallery extension - per the CVE title this requires an authenticated Joomla account with privileges to create or edit gallery content, although the supplied CVSS vector's PR:N contradicts this and should be verified. Execution additionally requires a victim to actively view the affected gallery page (CVSS UI:A), so it is not a fully automatic drive-by. Limiting factors: the flaw affects only Phoca Gallery versions 4.5.0 through 6.1.5 on Joomla, exploitation is bounded to the victim's browser context, and it depends on victim interaction plus (per the description) prior authenticated access. The specific gallery field or parameter carrying the injectable attribute is not described in the available sources.

This is a CWE-79 stored cross-site scripting flaw in the Phoca Gallery extension for Joomla (versions 4.5.0 through 6.1.5), carrying a vendor/EUVD CVSS 4.0 base score of 8.6. The signals conflict and must be reconciled before treating this as an 8.6-level emergency. The supplied CVSS 4.0 vector states PR:N (no privileges required), yet the CVE title explicitly says 'Authenticated stored cross-site scripting' - these directly contradict each other, so the true access requirement is unconfirmed; verify with the vendor before relying on the PR:N rating. The vector also sets VC:H/VI:H (high confidentiality and integrity impact), which is unusually high for a stored XSS whose impact is normally bounded to the victim's browser session; this appears inflated relative to the described HTML-attribute-injection mechanism. The input provides no EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference - the only reference is the vendor homepage (https://www.phoca.cz/), not a specific advisory. The vuln.today decision label is 'this_week', indicating a prioritized but non-emergency remediation cadence rather than act_now. Net assessment: a credible authenticated stored XSS warranting scheduled patching this week, but the headline 8.6 score is driven by metric choices (PR:N, VC:H/VI:H) that are inconsistent with the 'Authenticated' description and the typical impact of attribute-injection XSS.

An attacker with an authenticated Joomla account that can create or edit Phoca Gallery content injects a malicious HTML attribute payload that is stored by the gallery. When another user or administrator subsequently views the affected gallery page, the script executes in their browser session (UI:A), enabling session or action hijacking. No public exploit identified at time of analysis.