CVE-2026-92231
[20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch
Published Sep 25, 2026 · Joomla Joomla
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-02 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92231 Description The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector. Affected Installs Joomla! CMS versions 1.5.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4.9, 6.1.4 Contact The JSST at the Joomla! Security Centre . Reported By: Netanel Stern
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2026 · Joomla Security
Detected
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-02 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92231 Description The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities beforehand, causing
Sources
- CVE.orgVulnerability recordCVE-2026-92231
Official CVE identifier
cve.org - Joomla SecurityVendor advisoryCVE-2026-92231
Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-02 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92231 Description The checkAttribute method normalized an attribute valu
developer.joomla.org