Which versions of JMedia (Joomla) are affected by EUVD-2026-46057?

The JMedia media-manager extension for Joomla contains a critical cross-site scripting vulnerability (CVE-2026-60034) allowing code injection through malicious image file uploads, posing immediate…

How to fix or mitigate EUVD-2026-46057?

Within 24 hours, immediately disable the JMedia extension across all Joomla instances and audit server logs for suspicious SVG uploads or unauthorized access patterns. Within 7 days, evaluate and deploy a patched alternative media-management extension and implement compensating controls including strict file-type validation, upload directory isolation, and WAF rules to block script injection in image files. Within 30 days, complete migration to replacement media manager, apply security headers (X-Content-Type-Options: nosniff) to all upload directories via server configuration, and conduct forensic review of application logs for evidence of prior exploitation.

JMedia (Joomla) EUVD-2026-46057

Q: What is the CVSS score of EUVD-2026-46057?

EUVD-2026-46057 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-60034 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 Joomla

GHSA-jr2x-pvg7-cmq5

XSS Jmedia Extension For Joomla Themexpert Com

9.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Authenticated media upload gives PR:L; stored XSS needs a victim to view the file (UI:R); script runs in the browser across a security boundary (S:C) with limited C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:20 vuln.today

CVE Published

Jul 20, 2026 - 18:11 cve.org

CRITICAL 9.4

DescriptionCVE.org

The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS.

AnalysisAI

Stored and reflected cross-site scripting in ThemeXpert's JMedia media-manager extension for Joomla lets an attacker upload a malicious SVG file that, because it is served without an X-Content-Type-Options: nosniff header, is interpreted and executed as active script in the context of the site. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV, but the attack is well-understood and trivially reproducible. The supplied CVSS 4.0 base score of 9.4 appears inflated for a script-injection issue, so treat the raw number with caution.

Technical ContextAI

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). SVG is an XML-based image format that can embed <script> elements and event handlers; when a web application accepts SVG uploads and later serves them without sanitising the XML and without an X-Content-Type-Options: nosniff response header, browsers may MIME-sniff the response and render the SVG as an active document, executing any embedded JavaScript. The affected component is the JMedia media manager extension (cpe:2.3:a:themexpert.com:jmedia_extension_for_joomla:*), which handles user-supplied media in the Joomla CMS. The defect combines a missing upload sanitiser with a missing hardening header, so both the content and the transport-layer defenses fail.

RemediationAI

No vendor-released patch version is identified in the available data, so a specific fix version cannot be cited; monitor the ThemeXpert page (https://www.themexpert.com/joomla-extensions/joomla-media-manager) and Joomla VEL for an updated JMedia release and upgrade as soon as one is published. As concrete compensating controls in the meantime: disable or restrict SVG uploads in JMedia/Joomla media settings (trade-off: users lose SVG image support); configure the web server to send both X-Content-Type-Options: nosniff and a Content-Disposition: attachment header for served media so browsers download rather than render SVGs (trade-off: SVGs no longer display inline); serve user-uploaded media from a separate cookieless domain or sandbox with a restrictive Content-Security-Policy to neutralise script execution (trade-off: added deployment complexity); and limit media-upload permissions to trusted, high-privilege Joomla user groups only. Post-upload SVG sanitisation (e.g. stripping script/event handlers) is an additional layer if SVG support must remain.