CVE-2018-6378

MEDIUM

Joomla! < 3.8.8 - Cross-Site Scripting in Media Manager

Title source: llm

In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.

Core 3

Core References

Vendor Advisory x_refsource_misc

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

CVSS v3 6.1

EPSS 0.0168

EPSS Percentile 82.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-79

Status published

Products (1)

joomla/joomla\! < 3.8.8

Published May 22, 2018

Tracked Since Feb 18, 2026