CVE-2026-90914 in Joomla
Summary
by MITRE • 09/29/2026
Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The identified vulnerability represents a significant security flaw within the core media handling components of Joomla content management system. The fundamental technical flaw lies in a lack of proper input sanitization or escaping when these layout files process data passed from user-controlled sources, such as article metadata, module configurations, or third-party extensions that utilize the core media API. When an attacker can inject malicious script payloads into fields associated with audio or video tags, the application fails to neutralize special characters before rendering them in the browser context. This failure allows arbitrary JavaScript code to execute within the security context of the logged-in user's session, leading directly to a Cross-Site Scripting scenario classified under CWE-79: Improper Neutralization of Input During Web Page Generation.
From an operational perspective, this vulnerability poses severe risks to both end-users and site administrators who interact with media-rich content on compromised Joomla! installations. An attacker can leverage the stored or reflected nature of this XSS flaw to steal session cookies, hijack administrative sessions, perform actions on behalf of victims without their consent, or redirect users to malicious phishing sites designed to harvest credentials. In environments where multiple editors contribute content, a persistent XSS payload embedded in media metadata could be served to every visitor viewing that specific article or module, significantly expanding the attack surface beyond just authenticated administrators. The impact is particularly acute because audio and video elements are often embedded prominently on web pages, increasing the likelihood of user interaction with any injected malicious links or scripts disguised as legitimate media controls.
The exploitation vector for this vulnerability typically involves manipulating input fields that feed into the generic media layouts, such as title attributes, alt text, or custom metadata parameters associated with uploaded files. Since Joomla! relies heavily on these layout overrides and core rendering engines to display multimedia content consistently across templates, a flaw in the base logic affects all sites using standard configurations without specific patches applied by template developers. This aligns with ATT&CK technique T1059.007: JavaScript, where attackers use client-side scripts to bypass defenses and execute malicious actions within the browser environment. The persistence of this vulnerability across multiple major version lines indicates a systemic issue in how the framework handles untrusted data during the rendering phase of media objects rather than an isolated bug in a single component.
Mitigation strategies must focus on immediate patching and defensive coding practices until official updates are fully deployed across all affected infrastructure. Administrators should upgrade Joomla! to the latest patched version that addresses this specific CVE, ensuring that core files including the generic audio and video layout templates have been updated with proper output encoding functions such as htmlspecialchars or equivalent framework-specific escaping mechanisms. For sites unable to patch immediately due to compatibility constraints, implementing a Web Application Firewall can provide an additional layer of defense by filtering out requests containing known XSS payloads in media-related parameters. Furthermore, developers integrating custom modules should audit their code for any direct usage of these generic layouts and ensure that all data passed to them is strictly validated and escaped according to OWASP guidelines before rendering. Regular security audits focusing on input validation across all user-facing forms connected to media management will help prevent similar vulnerabilities from being introduced in future development cycles.