Joomla CMS EUVD-2026-89082

Requires an authenticated account with privileges to submit content processed by Joomla's InputFilter (PR:H), plus victim user interaction to render the stored/reflected payload (UI:P). The concrete technical prerequisite is supplying an attribute value whose 'javascript:' scheme is obscured with HTML5 character entities, which the checkAttribute method fails to decode before applying its 'javascript:' scheme regex. Exploitation is limited by: the need for a privileged (non-anonymous) submitter, the requirement that a victim subsequently view the content, and applicability only to Joomla 1.5.0-5.4.8 and 6.0.0-6.1.3 (and the standalone Framework Filter package) prior to the fix.

This is a moderate-priority, defense-in-depth filter bypass rather than a top-tier emergency. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L) scores 7.1, but the VC:H/VI:H impact ratings appear overstated for a stored/reflected XSS: successful exploitation runs script in a victim's browser session, which maps far more naturally to LOW confidentiality/integrity impact than HIGH. The two mitigating metrics are decisive: PR:H means the attacker must already hold a privileged account able to submit content through the InputFilter (e.g., an authenticated contributor/editor), and UI:P/UI:R means a victim must render the malicious attribute. No EPSS score, no CISA KEV listing, and no explicit POC reference are supplied. The CVSS temporal metric E:P (Proof-of-Concept) in the vector implies the vendor considers PoC-level maturity to exist, but no actual exploit code is referenced in the intelligence provided - do not treat E:P as confirmation of a public, weaponized exploit. Net: a real but privilege-gated web-app flaw in a hugely popular CMS; patch on normal cadence, prioritize sites with many semi-trusted content authors.

An authenticated Joomla user with content-editing rights submits an HTML attribute containing an HTML5-entity-encoded 'javascript:' scheme (e.g. in an href/src). Because InputFilter's checkAttribute normalizes the value before matching the 'javascript:' regex but does not decode HTML5 entities first, the payload passes the filter and is stored; when an admin or another user later views the content, the script executes in their browser. No public, weaponized exploit is referenced, though the CVSS vector's E:P metric indicates the vendor assesses proof-of-concept maturity.