Changeflow GovPing Data Privacy & Cybersecurity Joomla! Multiple Vulnerabilities - SQL Injectio...
Priority review Guidance Added Final

Joomla! Multiple Vulnerabilities - SQL Injection and XSS

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published April 1st, 2026
Detected April 1st, 2026
Email

Summary

CERT-FR issued an advisory warning of multiple vulnerabilities in Joomla! CMS versions 5.x prior to 5.4.4 and 6.x prior to 6.0.4. The vulnerabilities include SQL injection (SQLi), indirect cross-site scripting (XSS), arbitrary file deletion, and improper access checks in web service endpoints. Six CVEs are referenced: CVE-2026-21629, CVE-2026-21630, CVE-2026-21631, CVE-2026-21632, CVE-2026-23898, and CVE-2026-23899.

View original document View source feed page

What changed

CERT-FR published advisory CERTFR-2026-AVI-0384 detailing six distinct vulnerabilities discovered in Joomla! CMS. Affected versions are 6.x prior to 6.0.4 and 5.x prior to 5.4.4. The vulnerabilities include: SQL injection in com_content articles web service endpoint (CVE-2026-21630); XSS vectors in com-associations comparison view (CVE-2026-21631); multiple XSS vectors in various article title outputs (CVE-2026-21632); arbitrary file deletion in com-joomlaupdate (CVE-2026-21629); ACL hardening in com-ajax (CVE-2026-23898); and improper access checks in webservice endpoints (CVE-2026-23899).

Organizations running affected Joomla! versions should immediately identify their deployments and apply patches by updating to version 5.4.4 or 6.0.4 respectively. Patches are available through the official Joomla! Security Centre. While no formal compliance deadline is specified, the severity of SQL injection and arbitrary file deletion vulnerabilities warrants immediate action. Failure to patch could allow attackers to exfiltrate data, modify content, or execute arbitrary file operations on affected systems.

What to do next

  1. Identify all Joomla! installations and verify current version numbers
  2. Update affected instances to Joomla! 5.4.4 or 6.0.4 as appropriate
  3. Review access logs for suspicious activity targeting Joomla! endpoints

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 01 avril 2026 N° CERTFR-2026-AVI-0384 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Joomla!

Gestion du document

| Référence | CERTFR-2026-AVI-0384 |
| Titre | Multiples vulnérabilités dans Joomla! |
| Date de la première version | 01 avril 2026 |
| Date de la dernière version | 01 avril 2026 |
| Source(s) | Bulletin de sécurité Joomla! 1027-20260301 du 31 mars 2026
Bulletin de sécurité Joomla! 1028-20260302 du 31 mars 2026
Bulletin de sécurité Joomla! 1029-20260303 du 31 mars 2026
Bulletin de sécurité Joomla! 1030-20260304 du 31 mars 2026
Bulletin de sécurité Joomla! 1031-20260305 du 31 mars 2026
Bulletin de sécurité Joomla! 1032-20260306 du 31 mars 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à l'intégrité des données
  • Contournement de la politique de sécurité
  • Injection de code indirecte à distance (XSS)
  • Injection SQL (SQLi)

Systèmes affectés

  • Joomla! versions 6.x antérieures à 6.0.4
  • Joomla! versions antérieures à 5.4.4

Résumé

De multiples vulnérabilités ont été découvertes dans Joomla!. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, une injection SQL (SQLi) et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 01 avril 2026 Version initiale

Named provisions

Vulnérabilité SQL dans com-content XSS dans com-associations XSS dans les sorties de titres d'articles Suppression arbitraire de fichiers dans com-joomlaupdate Vérification d'accès dans les endpoints webservice

Related changes

Favicon for www.cert.ssi.gouv.fr Chrome Vulnerabilities - Actively Exploited CVE-2026-5281
Urgent Apr 01, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans les produits Microsoft
Priority review Apr 01, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in SonicWall Email Security
Priority review Apr 01, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cisa.gov CVE-2026-5281 Google Dawn Use-After-Free Added to KEV Catalog
Priority review Apr 01, 2026 • CISA ICS-CERT Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Critical CVSS 9.8 Vulnerabilities in Red Hat Ansible Allow Remote Code Execution
Urgent Apr 01, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity
Favicon for wid.cert-bund.de Joomla CMS Critical Vulnerabilities CVSS 9.8
Urgent Apr 01, 2026 • CERT-Bund Security Advisories • Data Privacy & Cybersecurity

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-FR
Published
April 1st, 2026
Instrument
Guidance
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
CERTFR-2026-AVI-0384

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Patch Management Vulnerability Remediation
Threshold
Joomla! versions 6.x prior to 6.0.4; Joomla! versions prior to 5.4.4
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Consumer Protection

Browse Categories

Agriculture & Food Safety 63 AI Regulation 3 Banking & Finance 266 Consumer & Competition 1 Consumer Protection 44 Courts & Legal 360 Data Privacy & Cybersecurity 74 Defense & National Security 52 Education 20 Energy 107 Environment 85 Government & Legislation 316 Healthcare 136 Housing 16 Immigration 9 Insurance 58 Labor & Employment 113 Legal & Courts 1 Pharma & Drug Safety 103 Securities & Markets 104 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Sanctions 124 Transportation 57

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.