CVE-2026-48947

Received Received - Intake

Improper Access Check in Joomla Media File Overwrite

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: Joomla! Project

Description

An improper access check allows privileged users to overwrite media files without editing permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-48947

EUVD

EUVD-2026-42069

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	cms	5.4.7
joomla	cms	6.1.2
joomla	cms	From 4.1.0 (inc) to 5.4.6 (inc)
joomla	cms	From 6.0.0 (inc) to 6.1.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2026-48947 is a security vulnerability in Joomla! CMS versions 4.1.0 through 5.4.6 and 6.0.0 through 6.1.1. It involves incorrect access control in the com_media webservice endpoints.

This flaw allows privileged users to overwrite media files without having the proper editing permissions, meaning that users with certain privileges can bypass restrictions that should prevent them from modifying media files.

Impact Analysis

This vulnerability can lead to unauthorized modification of media files by privileged users who should not have editing rights.

Such unauthorized overwriting of media files could result in content tampering, potential defacement, or the introduction of malicious files, which may affect the integrity and trustworthiness of the website.

Although the impact is considered moderate, the severity and probability are low.

To mitigate this risk, users are advised to upgrade to Joomla! versions 5.4.7 or 6.1.2 where the issue has been fixed.

Mitigation Strategies

To mitigate this vulnerability, users should upgrade Joomla! CMS to versions 5.4.7 or 6.1.2 or later.

This update fixes the incorrect access control in the com_media webservice endpoints that allowed privileged users to overwrite media files without proper editing permissions.

Hi! I’m here to help you understand CVE-2026-48947. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70