Alex Joseph
A significant security flaw has been discovered in Joomla!, a popular content management system. This vulnerability, identified as a Cross-Site Scripting (XSS) issue, could potentially allow malicious code to be executed within a user’s browser under certain conditions. It stems from an oversight in how HTML mail templates handle data, making them susceptible to attack.
For site administrators and developers using Joomla!, understanding and addressing this vulnerability is crucial to maintaining a secure online environment. The good news is that a fix has been released, making it straightforward to protect your website.
CVE Details
- Product: Joomla! CMS
- CVE ID: CVE-2026-90918
- Published Date: September 29, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This XSS vulnerability impacts specific versions of the Joomla! CMS. If your website is running on any of the following versions, it is considered vulnerable:
- Joomla! CMS versions 4.0.0 through 5.4.8
- Joomla! CMS versions 6.0.0 through 6.1.3
The core issue lies within the mail template feature, which, without proper escaping, creates avenues for Cross-Site Scripting attacks. This means an attacker could inject harmful scripts into email templates, which might then execute in the browser of anyone viewing those emails, potentially leading to unauthorized actions or data theft.
Current Status
As of its last modification on October 6, 2026, this vulnerability has been fully analyzed. The Joomla! Security Strike Team (JSST) has identified the root cause and, importantly, has provided a solution to mitigate the risk.
Severity Level
The vulnerability is rated as Medium Severity with a CVSS score of 5.3. This classification indicates that while the impact is moderate, and the probability of exploitation is also moderate, it is serious enough to warrant immediate attention. An XSS vulnerability can lead to various problems, including session hijacking, defacement of websites, or redirection to malicious sites, compromising user data and trust.
Possible Solutions
Fortunately, the Joomla! project has released patches to address this critical flaw. To secure your Joomla! installation against CVE-2026-90918, you must update your CMS to a patched version.
The recommended solution is to upgrade your Joomla! CMS to version 5.4.9 or 6.1.4 (or any subsequent stable release). These updates include the necessary escaping mechanisms to prevent XSS vectors in HTML mail templates.
The fix for this vulnerability was implemented on September 25, 2026. It is highly advised to apply these updates as soon as possible to protect your site and your users from potential attacks.
References
For more technical details and official advisories, please refer to the following:
- https://developer.joomla.org/security-centre/1088-20260908-core-xss-in-html-mail-templates.html
- https://www.joomla.org/
