CVE-2021-26032

MEDIUM

Joomla! 3.0.0-3.9.26 - Cross-Site Scripting via MediaHelper::canUpload

Title source: llm

Description

An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload, leading to XSS attack vectors.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc vendor-advisory

https://developer.joomla.org/security-centre/852-20210501-core-adding-html-to-the-executable-block-list-of-mediahelper-canupload.html

Scores

CVSS v3 6.1

EPSS 0.0071

EPSS Percentile 72.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

joomla/joomla\! 3.0.0 - 3.9.26

Published May 26, 2021

Tracked Since Feb 18, 2026