Joomla CMS EUVD-2026-89073

Exploitation requires an authenticated account with high enough privilege to submit HTML content that is processed by Joomla's InputFilter (PR:H), such as a content author/editor role, and requires a victim to subsequently view the stored content (UI:P). The specific trigger is an HTML data: URI in an attribute value padded with whitespace characters that circumvent the cleanAttribute cleanup routine. Limiting factors: it is not exploitable by anonymous/unauthenticated users, it depends on the victim rendering the injected content, and it affects only Joomla CMS 1.5.0-5.4.8 / 6.0.0-6.1.3 and the joomla_framework_filter_package; sites restricting HTML-authoring privileges are materially less exposed.

This is a stored XSS filter bypass in Joomla's InputFilter (cleanAttribute), which is meant to strip dangerous HTML data: URIs but can be evaded with injected whitespace. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L) scores 7.1 and, notably, carries the exploit-maturity metric E:P, indicating the vendor considers a proof-of-concept level of exploitability to exist - though no standalone POC link is provided in the intelligence. The vector's PR:H means exploitation requires an authenticated, high-privilege content author, and UI:P means a victim must view the injected content, both of which meaningfully constrain real-world abuse versus a drive-by unauthenticated XSS. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation; this reads as a real-but-bounded issue rather than an urgent internet-wide threat. The vendor's VC:H/VI:H (high confidentiality/integrity) is more aggressive than a typical XSS rating and reflects worst-case session/admin-account compromise; an independent CVSS 3.1 assessment lands lower (~6.9, C:L/I:L). Key gap to verify: the CVSS 4.0 vector supplies no SSVC automatable/technical-impact fields and no NVD 3.1 vector, so exploitation-status confidence rests solely on the vendor's E:P maturity flag.

An authenticated Joomla user with content-authoring privileges submits an article or HTML field containing an HTML data: URI padded with whitespace characters that slip past InputFilter's cleanAttribute sanitization. When a victim - typically an administrator or another user - views the stored content, the malicious script executes in their browser session. The vendor's E:P (proof-of-concept) exploit-maturity flag suggests demonstration code for the bypass technique is known, though no public POC link is provided.