Joomla CMS EUVD-2026-89114

Exploitation requires the attacker to already hold a high-privilege Joomla account (PR:H) - in practice a backend/administrator or equivalent role able to influence data passed to HTMLHelper::link - and requires a victim to subsequently render the page containing the malicious link (UI:P/UI:R). It affects Joomla core versions 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. The lack of escaping is in the core HTML Helper link method, so any core or third-party feature that builds links via this method is a potential injection sink. Limiting factors: the required privilege level, the mandatory victim interaction, and the absence of any known exploit code (E:U) substantially reduce realistic risk despite the network attack vector.

This is a self-reported Joomla core XSS (CWE-79) in the HTMLHelper::link method, disclosed by the vendor via advisory 20260901. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L) yields 5.9, but the vendor's high confidentiality and integrity impacts (VC:H/VI:H) appear OVERSTATED for a reflected/stored XSS flaw whose realistic outcome is session/token theft and limited action-in-context, not full compromise - a browser-scoped C:L/I:L is more defensible. The exploitability metric is explicitly E:U (no exploit code), and there is no EPSS score, no CISA KEV listing, and no public POC, so real-world risk is currently low-to-moderate. Two factors materially constrain exploitation and are consistent across the signals: PR:H means an attacker must already hold high (typically backend/administrator-level) privileges to inject the payload, and UI:P/UI:R means a victim must render the affected link. This is therefore a NARROW, privileged, interaction-dependent issue rather than a mass-exploitable network flaw - a real fix-during-maintenance priority given Joomla's ubiquity, but not an emergency.

An attacker with backend/administrator-level access to a Joomla site injects an unescaped payload into a value that flows into HTMLHelper::link; when another user (e.g., an administrator or content viewer) renders the page containing that link, the script executes in their browser session. No public exploit code exists (E:U), so this would require the attacker to craft the payload manually against the affected link-generation path.