CVE-2026-102786 in Gallery Extension
Summary
by MITRE • 10/23/2026
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Phoca Gallery extension for Joomla, affecting versions from 4.5.0 to 6.1.5, represents a significant security risk classified as an authenticated stored cross-site scripting (XSS) flaw. This specific type of attack vector allows malicious actors who have valid credentials on the target Joomla instance to inject harmful scripts into web pages viewed by other users. The root cause lies in insufficient input validation and sanitization mechanisms within the application's handling of HTML attributes during image metadata processing or gallery configuration updates. When an authenticated user, such as a site administrator or editor with permission to manage galleries, inputs data that includes raw HTML tags or JavaScript code within attribute fields, the system fails to properly escape these characters before rendering them in the browser context. This oversight enables the execution of arbitrary client-side scripts whenever another user accesses the affected gallery page or image view.
From a technical perspective, this vulnerability exploits the lack of strict output encoding when displaying user-supplied data that was previously stored in the database without adequate sanitization. The attacker can craft specific HTTP requests containing malicious payloads embedded within HTML attributes, such as onmouseover events or script injection via style properties. Because the input is processed and saved by the application for later retrieval, the attack persists across sessions, making it a stored XSS rather than a reflected one. This persistence ensures that every time an unsuspecting user loads the compromised page, their browser executes the injected code in the context of the vulnerable website. The impact extends beyond simple script execution; attackers can leverage this capability to steal session cookies, hijack administrative accounts through credential harvesting, perform actions on behalf of victims such as modifying gallery settings or deleting content, and potentially use the victim's browser for further phishing campaigns against other site users.
The operational impact of this vulnerability is severe due to its authenticated nature and stored persistence. Unlike unauthenticated vulnerabilities that require social engineering to trick a user into clicking a malicious link, this flaw requires only valid login credentials, which are often easier to obtain through brute force attacks or credential stuffing if weak passwords are in use. Once inside the system, an attacker with even minimal privileges can propagate the attack widely by targeting high-traffic gallery pages. The trust relationship between the browser and the website is abused, allowing the malicious script to access sensitive data protected by same-origin policy restrictions. This can lead to complete compromise of user accounts if session tokens are exfiltrated, potentially escalating to full server control if combined with other vulnerabilities or misconfigurations that allow for remote code execution through administrative functions exposed via XSS payloads.
Mitigation strategies must focus on both immediate remediation and long-term secure coding practices. The primary defense is the application of strict input validation and output encoding. Developers should implement a whitelist approach for allowed HTML tags and attributes, ensuring that only safe elements are permitted while stripping or escaping all others. Specifically, context-sensitive output encoding must be applied when rendering user-supplied data in HTML attribute contexts to prevent script injection. For administrators using affected versions, the immediate action is to upgrade Phoca Gallery to version 6.1.6 or later where this issue has been patched. Additionally, implementing a Content Security Policy (CSP) can significantly mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts can be loaded and executed. Regular security audits and code reviews focusing on data flow between user input and browser output are essential to prevent similar flaws in future updates or other extensions within the Joomla ecosystem.
This vulnerability aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting, and specifically relates to CWE-80 for improper sanitization in HTML attributes. In terms of the MITRE ATT&CK framework, this attack vector maps to T1189 Drive-by Client Side Code Execution or more accurately T1059 Command and Scripting Interpreter if used for further exploitation, but primarily falls under TA0001 Initial Access via compromised credentials leading to persistence through stored payloads. Understanding these classifications helps security teams prioritize patching efforts and enhance monitoring capabilities to detect attempts at exploiting similar injection flaws across web applications that handle user-generated content with insufficient sanitization protocols.