Joomla! CMS EUVD-2026-42062

Exploitation requires an authenticated session with high-privilege access (PR:H per CVSS 4.0 - Super Administrator or Administrator role on the target Joomla installation) to inject the XSS payload into the generic image output layout component in the first place. A second authenticated user must then passively view the rendered output containing the injected payload (UI:P) for script execution to occur in that victim's browser context. What limits exploitation: the mandatory pre-existing high-privileged credentials rule out unauthenticated or low-privileged remote attackers entirely; the attack is bounded to insider threats, phishing-compromised admin accounts, or as a second stage following initial privilege escalation. Remote unauthenticated exploitation is not possible per PR:H. No specific non-default configuration is documented as required beyond standard Joomla CMS deployment with the image output layout in use.

The CVSS 4.0 vector scores 5.9 (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U). The high privilege requirement (PR:H) is the dominant mitigating factor - an attacker must already possess Super Administrator or Administrator credentials to inject the payload into the image layout. Passive user interaction (UI:P) introduces a second dependency: a separate authenticated user must view the affected page. Despite these constraints, the impact metrics (VC:H/VI:H) reflect that successful exploitation can yield full session compromise of the victim's account, which for an admin-level victim equates to complete CMS control. The E:U supplement confirms no known public exploit exists, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data was not provided in the available intelligence. In aggregate, this is a real but narrowly exploitable vulnerability: the attack surface is bounded by the requirement for pre-existing privileged access, making insider threats or compromised admin accounts the realistic threat model rather than opportunistic remote attackers. It does not warrant emergency response but should be patched in the normal update cycle.

An insider threat or attacker who has compromised a Super Administrator or Administrator account crafts a malicious payload embedded in an image layout value within the Joomla backend, targeting the generic image output component. When a second authenticated user - such as an editor, manager, or another administrator - navigates to the page that renders the affected image output, the unescaped payload executes as JavaScript in their browser session, allowing the attacker to capture the victim's session cookie and impersonate them across the Joomla backend. No public exploit code has been identified at time of analysis.