Joomla! CMS EUVD-2026-31888

The attacker must possess valid high-privilege Joomla! credentials (CVSS PR:H), reach a Joomla! instance running version 3.2.1-5.4.5 or 6.0.0-6.1.0 over the network, and submit a manipulated 'layout' parameter to the htmlview component as described in the Joomla! Security Centre advisory 1041-20260509. The AT:P (attack requirements: present) flag indicates an additional non-default precondition beyond authentication, consistent with reaching a specific htmlview route or template-rendering context; no user interaction is required (UI:N). Exploitation is limited by the administrative authentication barrier, by the absence of any public exploit, and by CISA SSVC marking the issue as not automatable.

The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:H/UI:N reports a network-reachable, low-complexity attack with high confidentiality, integrity, and availability impact on the vulnerable component, but it requires high privileges (PR:H) and a present attack requirement (AT:P), substantially narrowing the realistic attacker pool to authenticated administrators or similarly privileged Joomla! users. This is reinforced by CISA SSVC scoring Exploitation as 'none' and Automatable as 'no' even though Technical Impact is 'total', and by an EPSS score of 0.00% indicating no observed exploitation activity in the wild. The combined signals are internally consistent: a serious file-read primitive gated behind administrative access, suitable for post-compromise privilege escalation or data theft but unlikely to drive mass exploitation. No public exploit identified at time of analysis, and the description does not specify which exact endpoint or component path is vulnerable, so defenders should treat the Joomla! advisory as the authoritative scope reference.

An attacker who has obtained or compromised a high-privilege Joomla! account (for example, through phished administrator credentials or via a separate authentication bypass) sends a crafted HTTP request to an htmlview endpoint with a manipulated 'layout' parameter containing traversal sequences, causing Joomla! to include and disclose the contents of configuration.php or other sensitive server files. The recovered database credentials or secret keys then enable broader compromise of the site and backing database. No public exploit identified at time of analysis.