CVE-2026-48901
InputFilter Security Parameter Omission in Joomla
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: Joomla! Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| joomla | joomla | From 5.4.6 (inc) |
| joomla | joomla | From 6.1.1 (inc) |
| joomla | joomla | From 4.0.0 (inc) to 5.4.6 (exc) |
| joomla | joomla | From 6.0.0 (inc) to 6.1.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-48901 is a security vulnerability in Joomla! CMS versions 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The issue lies in the InputFilter::getInstance() method, which incorrectly constructs cache keys by omitting a security-sensitive parameter.
Because of this omission, the cache key does not uniquely identify instances based on all relevant security parameters, potentially allowing attackers to bypass security measures or manipulate cached data.
How can this vulnerability impact me? :
This vulnerability could allow attackers to bypass security controls or manipulate cached data within the Joomla! CMS.
Such manipulation or bypass could lead to unauthorized access or unintended behavior in the application, although the severity, impact, and probability of exploitation are considered low.
To mitigate this risk, users should upgrade to Joomla! versions 5.4.6 or 6.1.1 where the issue has been fixed.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-48901, users should upgrade their Joomla! CMS installations to versions 5.4.6 or 6.1.1 or later.
This update fixes the issue in the InputFilter::getInstance() method where a security-sensitive parameter was omitted from the cache key, preventing potential security bypass or cache manipulation.