Joomla! Framework Filter EUVD-2026-31891

Exploitation requires an authenticated account with high privileges (PR:H per CVSS 4.0), confining the initial injection step to backend administrators or equivalently elevated roles - standard site visitors cannot inject the payload. A second, distinct user must passively view the page containing the injected content for execution to occur (UI:P). The vulnerability is specifically triggered through code paths invoking the checkAttribute methods of the Joomla! Framework Filter package; components that do not route HTML attribute input through these methods are not exposed. Factors limiting exploitation include: the high privilege bar for injection, the requirement for a passive victim interaction, SSVC classification as non-automatable, and no evidence of active exploitation. No non-default configuration is documented as required.

The CVSS 4.0 score of 6.9 is moderate and accurately reflects the realistic constraints on exploitation. While the attack vector is network-accessible and complexity is low, the PR:H requirement means only highly privileged accounts - administrators or equivalent backend roles - can introduce the malicious payload. The UI:P requirement adds a second gating condition: a victim must passively view the injected content. VC:H (high confidentiality impact) likely reflects the XSS potential for session token theft, but this impact is bounded by the PR:H prerequisite. EPSS at 0.01% (0th percentile) and SSVC classification of exploitation: none, automatable: no, and technical impact: partial collectively indicate that this vulnerability is not being actively targeted and is not amenable to mass automation. No CISA KEV listing. This is a genuine but lower-priority finding that should be patched in routine maintenance rather than treated as a critical emergency.

An authenticated high-privilege user - such as a Joomla! backend administrator - submits content containing a crafted HTML attribute value designed to bypass the checkAttribute filter, embedding a JavaScript payload into stored page content. When a separate user browses the affected page, their browser renders and executes the injected script, enabling the attacker to steal session cookies or impersonate the victim. No public exploit code has been identified at time of analysis.