Alex Joseph
Understanding the Joomla! Core XSS Vulnerability
A security flaw, identified as CVE-2026-90914, has been discovered in Joomla! Core. This vulnerability is a type of Cross-Site Scripting (XSS) that affects the way Joomla handles audio and video content. Simply put, a lack of proper checks allows malicious code to be inserted into the generic media output layouts. If exploited, this could lead to various attacks, such as stealing user information or altering website content.
CVE Details
Product Name: Joomla! Core
Published Date: September 29, 2026
Severity: Medium
Status: Analyzed (Fixed as of September 25, 2026)
Affected Products
This XSS vulnerability impacts specific versions of the Joomla! Content Management System (CMS):
- Joomla! CMS versions 4.0.0 through 5.4.8
- Joomla! CMS versions 6.0.0 through 6.1.3
Users running any of these versions are at risk until they apply the recommended update.
Current Status
The vulnerability has been thoroughly analyzed by the Joomla! Security Strike Team. A fix was released on September 25, 2026, addressing the issue in affected Joomla! Core versions. It is crucial for administrators and developers to update their installations promptly to protect their websites.
Severity Level
Rated as “Medium” severity, this Cross-Site Scripting (XSS) vulnerability can still pose a significant threat. An XSS flaw allows attackers to inject client-side scripts into web pages viewed by other users. This can lead to:
- Session hijacking, where an attacker could steal a user’s session cookies and take over their account.
- Defacement of the website.
- Redirection to malicious websites.
- Execution of arbitrary code in the victim’s browser, potentially leading to data theft or compromise of user accounts.
While not immediately granting full server control, the potential for impacting user trust and data makes this a serious concern.
Possible Solutions
The good news is that Joomla! has released updates to address this vulnerability. To secure your Joomla! installation, you should:
- Upgrade Joomla! CMS to version 5.4.9 if you are running a 5.x branch.
- Upgrade Joomla! CMS to version 6.1.4 if you are running a 6.x branch.
It is always recommended to back up your website before performing any updates. Always download updates from the official Joomla! website or through your CMS’s administrative interface.
References
https://developer.joomla.org/security-centre/1084-20260904-core-xss-in-the-generic-media-output-layouts.html
https://www.joomla.org/
