Alex Joseph
A critical security flaw, identified as CVE-2026-73373, has been discovered in Joomla! Core, a widely used content management system. This vulnerability stems from an oversight where the system allowed unrestricted uploads of SHTML files. If a web server was configured to execute these SHTML files, an attacker could potentially upload malicious code, leading to unauthorized code execution on the server. This is a serious risk that could allow attackers to take full control of affected websites.
CVE Details
- Product Name: Joomla! Core
- CVE ID: CVE-2026-73373
- Published Date: August 18, 2026
- Severity: CRITICAL
- Status: Analyzed
Affected Products
The vulnerability affects a broad range of Joomla! CMS versions:
- Joomla! versions from 1.0.0 up to and including 5.4.7
- Joomla! versions from 6.0.0 up to and including 6.1.2
Current Status
This vulnerability, CVE-2026-73373, has been thoroughly analyzed. The issue was reported on July 29, 2026, and a fix was promptly released on August 18, 2026, coinciding with the CVE’s publication.
Severity Level
The National Vulnerability Database (NVD) has assigned this vulnerability a CRITICAL severity rating with a CVSS score of 9.8. This high score indicates a severe risk, meaning the vulnerability is easy to exploit and could lead to significant damage, including remote code execution and full system compromise if exploited on a misconfigured server.
Possible Solutions
Joomla! has released patches to address this critical vulnerability. All users of affected Joomla! versions are strongly advised to upgrade immediately to the patched versions:
- Upgrade to Joomla! version 5.4.8
- Upgrade to Joomla! version 6.1.3
Regularly updating your CMS and server configurations to disallow execution of unknown or untrusted file types is always a good security practice. Consider reviewing your server’s MIME types and handler configurations for executable file types.
References
- https://developer.joomla.org/security-centre/1077-20260810-core-unrestricted-uploads-of-shtml-files.html
- https://www.joomla.org/
