Cache Key Construction Flaw in Joomla's InputFilter Method
CVE-2026-48901

7.5HIGH

Key Information:

Vendor

Joomla
Status
Joomla! Cms
Vendor
CVE Published:
26 May 2026

What is CVE-2026-48901?

A security-sensitive parameter has been omitted from the instance cache key in the InputFilter::getInstance() method of Joomla. This oversight could potentially lead to unauthorized information disclosure or exploitation by attackers who can manipulate the caching mechanism, thus impacting the integrity of the Joomla application. It is important for system administrators to review and apply the necessary security patches to mitigate this vulnerability.

Affected Version(s)

Joomla! CMS 4.0.0-5.4.5

Joomla! CMS 6.0.0-6.1.0

References

https://developer.joomla.org/security-centre/1049-2026051...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

@ZeroXJacks, https://github.com/ZeroXJacks
.