Joomla: Mehrere Schwachstellen
WID-SEC-2026-1688 · first 27.05.2026 · updated 09.07.2026 · CVSS 7,2
What it is about
Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden. Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Joomla ausnutzen, um Angriffe wie Cross-Site Scripting (XSS), SQL-Injection, Privilegienerweiterung, Umgehung der Authentifizierung, Path Traversal, Local File Inclusion (LFI) und unbefugten Zugriff durchzuführen.
Under what conditions?
Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.
What can happen in the worst case
An attacker could use the vulnerability to
- Angriffe wie Cross-Site Scripting (XSS)
- SQL-Injection
- Privilegienerweiterung
- Umgehung der Authentifizierung
- Path Traversal
- Local File Inclusion (LFI)
- unbefugten Zugriff durchzuführen
Am I affected?
Affected according to the BSI:
- Open Source Joomla <5.4.6
- Open Source Joomla <6.1.1
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Joomla 5.4.6
- Open Source Joomla 6.1.1
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Joomla 6.1.1 & 5.4.6 Security & Bugfix Release vom 2026-05-26 www.joomla.org
- Joomla Security Advisory 20260501 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260502 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260503 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260504 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260505 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260506 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260507 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260508 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260509 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260510 vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260511 - Core - MFA Authentication Bypass vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260512 - Core - MFA Authentication Bypass vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260513 - Core - Privilege escalation through com_users batch task vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260515 - Core - Incorrect Access Control in sample data plugins vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260516 - Core - Incorrect Access Control in com_scheduler vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260517 - Core - Incorrect Cache Key Construction for InputFilter objects vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260518 - Core - Transport encryption downgrade for password and username reset links vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260519 - Framework - Inadequate content filtering within the checkAttribute filter code vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260514 - Core - Privilege escalation through com_users webservice endpoints vom 2026-05-26 developer.joomla.org
- Joomla Security Advisory 20260520 - Framework - Inadequate content filtering within the cleanAttributes filter code vom 2026-05-26 developer.joomla.org
- Joomla Exploits vom 2026-07-08 github.com
CVE: CVE-2026-25900, CVE-2026-25901, CVE-2026-30894, CVE-2026-30895, CVE-2026-35220, CVE-2026-35221, CVE-2026-35222, CVE-2026-35223, CVE-2026-40383, CVE-2026-40384, CVE-2026-48896, CVE-2026-48897, CVE-2026-48898, CVE-2026-48899, CVE-2026-48900, CVE-2026-48901, CVE-2026-48902, CVE-2026-48903, CVE-2026-48904, CVE-2026-48905
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.