CVE-2026-90906
[20260901] - Core - XSS in HTMLHelper::link method
Published Sep 25, 2026 · Joomla Joomla
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-09 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90906 Description Lack of escaping leads to XSS vulnerabilities in the link method of the HTMLHelper. Affected Installs Joomla! CMS versions 1.5.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4.9, 6.1.4 Contact The JSST at the Joomla! Security Centre . Reported By: Demyanchuk V.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2026 · Joomla Security
Detected
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-09 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90906 Description Lack of escaping leads to XSS vulnerabilities in the link method of the HTMLHelper. Affected Installs Joomla! CMS versions 1.5.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to versio
Sources
- Joomla SecurityVendor advisoryCVE-2026-90906
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-09 Fixed Date: 2026-09-25 CVE Number: CVE-2026-90906 Description Lack of escaping leads to XSS vulnerabilities in the l
developer.joomla.org