Joomla
Joomla! released patches for 21 vulnerabilities in versions 5.x and 6.x, including XSS, SQL injection, privilege escalation, and MFA bypass flaws.
The French CERT-FR has issued an advisory regarding multiple vulnerabilities discovered in Joomla! content management system affecting versions 6.x prior to 6.1.1 and versions prior to 5.4.6. The vulnerability set includes cross-site scripting (XSS) flaws in various components including feed modules, com_associations, com_contenthistory, and readmore links. Additionally, authenticated blind SQL injection vulnerabilities were identified in com_finder and com_tags components.
Several critical access control and privilege escalation issues were discovered, including improper access checks in webservice endpoints, privilege escalation through com_users batch tasks and webservice endpoints, and incorrect access control in sample data plugins and com_scheduler. Path traversal and local file inclusion vulnerabilities were found in com_media webservice endpoints and HTMLView layout parameters respectively.
Notably, the advisory identifies multi-factor authentication (MFA) bypass vulnerabilities and a transport encryption downgrade issue affecting password and username reset links. CSRF vulnerabilities in user activation endpoints and inadequate content filtering in the framework's checkAttribute and cleanAttributes filter code round out the comprehensive list of security issues. Organizations running affected Joomla! versions should prioritize patching to versions 5.4.6 or 6.1.1 as appropriate.
Mentioned in this report
Detection guidance
Joomla com_media Webservice Path Traversal Attempt
Detects path traversal patterns in requests to Joomla com_media webservice API endpoints, consistent with the disclosed LFI/path traversal vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Joomla com_media Webservice Path Traversal Attempt
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /api/index.php/v1/media
traversal:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- ..\\
condition: selection and traversal
falsepositives:
- Legitimate media management API calls that happen to include encoded slashes in
filenames (rare)
level: high
tags:
- attack.t1190
id: f59cd229-5e42-5414-ac37-1dd2371ddff8
status: experimental
author: Vorant
Joomla com_finder or com_tags Blind SQL Injection Probe
Detects SQL injection indicator strings in query parameters targeting Joomla com_finder or com_tags components, matching the reported authenticated blind SQLi vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Joomla com_finder or com_tags Blind SQL Injection Probe
logsource:
category: webserver
detection:
selection_component:
cs-uri-query|contains:
- option=com_finder
- option=com_tags
selection_sqli:
cs-uri-query|contains:
- UNION SELECT
- union select
- SLEEP(
- sleep(
- ' OR 1=1'
- ''' OR ''1''=''1'
- benchmark(
- BENCHMARK(
condition: selection_component and selection_sqli
falsepositives:
- Security scanning tools authorized to test the Joomla instance
- Automated vulnerability assessments run by internal security teams
level: high
tags:
- attack.t1190
id: 716a8f70-ce51-599b-99d5-909cdf27530a
status: experimental
author: Vorant
Joomla com_users Batch Webservice Privilege Escalation Attempt
Detects webservice API calls to Joomla com_users batch endpoints that alter user group membership, matching the reported privilege escalation vulnerability via com_users batch tasks and webservice endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Joomla com_users Batch Webservice Privilege Escalation Attempt
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- /api/index.php/v1/users
- /api/index.php/v1/user
selection_method:
cs-method: POST
selection_batch:
cs-uri-query|contains:
- batch
- group_id
- usergroup
condition: selection_endpoint and selection_method and selection_batch
falsepositives:
- Legitimate administrative bulk user management performed by authorized Joomla super
users
level: medium
tags:
- attack.t1078
- attack.t1190
id: c41d8311-bb59-5c8d-92d1-b8e739cdddc5
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0649
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free