CVE-2026-48903
Analyzed Analyzed - Analysis Complete
XSS in Joomla CMS Components

Publication date: 2026-05-26

Last updated on: 2026-05-26

Assigner: Joomla! Project

Description
Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-26
Last Modified
2026-05-26
Generated
2026-06-16
AI Q&A
2026-05-26
EPSS Evaluated
2026-06-14
NVD
CVE-2026-48903
EUVD
EUVD-2026-31891
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
joomla joomla! From 3.0.0 (inc) to 5.4.6 (exc)
joomla joomla! From 6.0.0 (inc) to 6.1.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-48903 is a vulnerability found in the Joomla! Framework and CMS versions 3.0.0-5.4.5 and 6.0.0-6.1.0. It is caused by inadequate content filtering within the checkAttribute filter methods.

This flaw allows cross-site scripting (XSS) attacks in various components, meaning that malicious scripts can be injected and executed in the context of the affected web application.

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks, which may allow attackers to execute malicious scripts in users' browsers.

  • Steal sensitive information such as cookies or session tokens.
  • Perform actions on behalf of the user without their consent.
  • Compromise the integrity and security of the affected Joomla! website or application.

Users are advised to upgrade to Joomla! versions 5.4.6 or 6.1.1 to mitigate this risk.

Mitigation Strategies

To mitigate the CVE-2026-48903 vulnerability, users should upgrade their Joomla! Framework and CMS installations to versions 5.4.6 or 6.1.1 or later.

This update addresses the inadequate content filtering in the checkAttribute filter methods that leads to cross-site scripting (XSS) vulnerabilities.

Compliance Impact

The vulnerability involves inadequate content filtering leading to cross-site scripting (XSS) issues, which can potentially expose user data or allow unauthorized actions within affected Joomla! components.

Such XSS vulnerabilities can impact compliance with data protection regulations like GDPR and HIPAA by increasing the risk of unauthorized access or data breaches, as these standards require appropriate security measures to protect personal and sensitive information.

However, the provided information does not explicitly detail the direct effects on compliance with these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart