Joomla: Mehrere Schwachstellen
WID-SEC-2026-3636 · first 30.09.2026 · updated 30.09.2026 · CVSS 8,0
What it is about
Joomla ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden. Ein Angreifer kann mehrere Schwachstellen in Joomla ausnutzen um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, sensible Daten offenzulegen oder zu manipulieren und seine Berechtigungen zu erweitern.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
Am I affected?
Affected according to the BSI:
- Open Source Joomla Core <5.4.9
- Open Source Joomla Core <6.1.4
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Joomla Core 5.4.9
- Open Source Joomla Core 6.1.4
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Joomla Security Centre vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260901 - Core - XSS in HTMLHelper::link method vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260902 - Core - Unauthorized user account creation via profile.save controller vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260903 - Core - Improper ACL checks for access level webservice endpoints vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260904 - Core - XSS in the generic media output layouts vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260905 - Core - Arbitrary directory deletion via cache purge action vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260906 - Core - Improper ACL checks in content history comparison view vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260907 - Core - Improper ACL checks in outputs for tagged items vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260908 - Core - XSS in HTML Mail Templates vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260909 - Core - SSRF vectors in various core extensions vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260910 - Core - Improper ACL checks for workflow stage changes vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260911 - Core - XSS in link toolbar layout vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260912 - Core - XSS in module list vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260913 - Core - Improper ACL checks for various webservice edit tasks vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260914 - Core - MFA Authentication Bypass through rememberme cookies vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260915 - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch vom 2026-09-29 developer.joomla.org
- Joomla Security Advisory 20260916 - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs vom 2026-09-29 developer.joomla.org
CVE: CVE-2026-90906, CVE-2026-90907, CVE-2026-90913, CVE-2026-90914, CVE-2026-90915, CVE-2026-90916, CVE-2026-90917, CVE-2026-90918, CVE-2026-92222, CVE-2026-92223, CVE-2026-92224, CVE-2026-92225, CVE-2026-92226, CVE-2026-92227, CVE-2026-92231, CVE-2026-92232
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.