ZeroDay Findings
Sign inSign up

Findings

CVE-2026-92232

[20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs

Published Sep 25, 2026 · Joomla Joomla

Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-19 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92232 Description The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector. Affected Installs Joomla! CMS versions 1.5.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4.9, 6.1.4 Contact The JSST at the Joomla! Security Centre . Reported By: arib06

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 25, 2026 · Joomla Security

    Detected

    Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-19 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92232 Description The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector. Affected Installs Joomla! CMS

Sources

  • Joomla SecurityVendor advisoryCVE-2026-92232

    Project: Joomla! SubProject: CMS Impact: Moderate Severity: Moderate Probability: Low Versions: 1.5.0-5.4.8,6.0.0-6.1.3 Exploit type: XSS Reported Date: 2026-08-19 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92232 Description The cleanAttribute method removes HTML data URIs, howe

    developer.joomla.org