EUVD-2026-42059
GHSA-2hjh-jp76-w6fv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H reflects mandatory admin access; UI:R captures victim page-load dependency; S:C applies because payload executes in a different user's browser context.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Improper validation leads to a generic XSS vector in the language override feature.
AnalysisAI
Stored XSS in Joomla CMS's language override administrative feature allows a high-privileged attacker to inject malicious scripts that execute in the browser of any user who subsequently renders the affected language string. Rooted in CWE-79 (improper output neutralization), the vulnerability requires an administrative account to place the payload but can then target other admins or front-end users. No public exploit code has been identified at time of analysis (CVSS E:U), and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Joomla CMS (cpe:2.3:a:joomla!_project:joomla!_cms) includes a language override system that allows administrators to customize language strings displayed across both the administrative back-end and the public front-end. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that values submitted to this feature are not adequately sanitized or escaped before being stored and later rendered in HTML contexts. The attack vector is network-based (AV:N), consistent with a web application vulnerability accessible via HTTP. Because language override strings can surface in front-end templates as well as back-end administrative views, a stored payload has the potential to execute in multiple rendering contexts. The CVSS 4.0 supplemental metric E:U confirms no reported or observed exploitation, and SC:N/SI:N/SA:N indicates no lateral scope change to downstream systems beyond the vulnerable Joomla instance itself.
RemediationAI
Apply the patch or upgrade to the fixed Joomla CMS version identified in the official Joomla Security Centre advisory published 2026-07-08 at https://developer.joomla.org/security-centre/1062-20260708-core-xss-through-language-overrides.html. An exact patched version number is not independently confirmed from the data provided; consult the advisory directly to identify the minimum safe release for your branch. As a compensating control prior to patching, restrict access to the language override administrative panel using Joomla's built-in Access Control List (ACL) system, limiting write permissions to only the minimum number of fully trusted super-administrators. Auditing existing language override entries for unexpected script tags or event handler attributes (e.g., onerror, onload) can identify whether the vulnerability has already been exploited. Note that restricting ACL access does not eliminate the vulnerability but reduces the attack surface by narrowing who can introduce a payload.
More in Joomla Cms
View allTransport encryption downgrade in Joomla! CMS password and username reset workflows causes reset links to be generated w
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, imp
Path traversal (Zip Slip) in Joomla 6.1.1's com_joomlaupdate component enables persistent remote code execution when a S
Arbitrary file deletion in Joomla! CMS com_joomlaupdate component via the autoupdate server mechanism allows remote atta
Authorization bypass in Joomla CMS com_config webservice endpoints allows authenticated attackers with high privileges t
Improper access control in Joomla! CMS webservice endpoints allows unauthorized attackers to bypass authentication and a
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with ins
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote att
Authentication bypass in Joomla! CMS 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumvent multi-factor auth
Two-factor authentication bypass in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to circumve
Privilege escalation in Joomla! CMS versions 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 allows remote attackers to abus
Privilege escalation in Joomla! CMS versions 4.0.0-5.4.5 and 6.0.0-6.1.0 allows remote attackers to abuse the com_users
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today