Joomla
Joomla! released patches for 21 vulnerabilities in versions 5.x and 6.x, including XSS, SQL injection, privilege escalation, and MFA bypass flaws.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 20 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French CERT-FR has issued an advisory regarding multiple vulnerabilities discovered in Joomla! content management system affecting versions 6.x prior to 6.1.1 and versions prior to 5.4.6. The vulnerability set includes cross-site scripting (XSS) flaws in various components including feed modules, com_associations, com_contenthistory, and readmore links. Additionally, authenticated blind SQL injection vulnerabilities were identified in com_finder and com_tags components.
Several critical access control and privilege escalation issues were discovered, including improper access checks in webservice endpoints, privilege escalation through com_users batch tasks and webservice endpoints, and incorrect access control in sample data plugins and com_scheduler. Path traversal and local file inclusion vulnerabilities were found in com_media webservice endpoints and HTMLView layout parameters respectively.
Notably, the advisory identifies multi-factor authentication (MFA) bypass vulnerabilities and a transport encryption downgrade issue affecting password and username reset links. CSRF vulnerabilities in user activation endpoints and inadequate content filtering in the framework's checkAttribute and cleanAttributes filter code round out the comprehensive list of security issues. Organizations running affected Joomla! versions should prioritize patching to versions 5.4.6 or 6.1.1 as appropriate.
Mentioned in this report
Detection guidance
Joomla com_media Webservice Path Traversal Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects path traversal patterns in requests to Joomla com_media webservice API endpoints, consistent with the disclosed LFI/path traversal vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Joomla com_media Webservice Path Traversal Attempt
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /api/index.php/v1/media
traversal:
cs-uri-query|contains:
- ../
- ..%2f
- '%2e%2e%2f'
- ..\\
condition: selection and traversal
falsepositives:
- Legitimate media management API calls that happen to include encoded slashes in
filenames (rare)
level: high
tags:
- attack.t1190
id: f59cd229-5e42-5414-ac37-1dd2371ddff8
status: experimental
author: Vorant
Joomla com_finder or com_tags Blind SQL Injection Probe
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SQL injection indicator strings in query parameters targeting Joomla com_finder or com_tags components, matching the reported authenticated blind SQLi vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Joomla com_finder or com_tags Blind SQL Injection Probe
logsource:
category: webserver
detection:
selection_component:
cs-uri-query|contains:
- option=com_finder
- option=com_tags
selection_sqli:
cs-uri-query|contains:
- UNION SELECT
- union select
- SLEEP(
- sleep(
- ' OR 1=1'
- ''' OR ''1''=''1'
- benchmark(
- BENCHMARK(
condition: selection_component and selection_sqli
falsepositives:
- Security scanning tools authorized to test the Joomla instance
- Automated vulnerability assessments run by internal security teams
level: high
tags:
- attack.t1190
id: 716a8f70-ce51-599b-99d5-909cdf27530a
status: experimental
author: Vorant
Joomla com_users Batch Webservice Privilege Escalation Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects webservice API calls to Joomla com_users batch endpoints that alter user group membership, matching the reported privilege escalation vulnerability via com_users batch tasks and webservice endpoints. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Joomla com_users Batch Webservice Privilege Escalation Attempt
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- /api/index.php/v1/users
- /api/index.php/v1/user
selection_method:
cs-method: POST
selection_batch:
cs-uri-query|contains:
- batch
- group_id
- usergroup
condition: selection_endpoint and selection_method and selection_batch
falsepositives:
- Legitimate administrative bulk user management performed by authorized Joomla super
users
level: medium
tags:
- attack.t1078
- attack.t1190
id: c41d8311-bb59-5c8d-92d1-b8e739cdddc5
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0649
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs