CVE-2026-64795

Received Received - Intake

HTML Injection in Joomla CMS

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Joomla! Project

Description

Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-64795

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla	------*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability allows a content author to inject JavaScript code through custom HTML, module content or title overrides, and decoded modal or tooltip values. The injected JavaScript would then execute in the browsers of visitors to the site.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious scripts in users' browsers. This may lead to theft of session cookies, account takeovers, or other client-side attacks against visitors.

Compliance Impact

This vulnerability allows content authors to inject JavaScript that executes in visitors' browsers, which could lead to unauthorized data access or manipulation. This may violate GDPR's requirement for protecting personal data and HIPAA's safeguards for protected health information by enabling cross-site scripting attacks.

Mitigation Strategies

Update Joomla to the latest version immediately as this vulnerability involves unsafe markup execution through custom HTML and overrides. Review and sanitize all user-provided content, especially module content, titles, modals, and tooltips. Disable unnecessary HTML input capabilities for non-trusted users.

Hi! I’m here to help you understand CVE-2026-64795. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70