Header Injection Vulnerability in Joomla! Core Products
CVE-2026-71572

4.8MEDIUM

Key Information:

Vendor

Joomla
Status
Joomla! Cms
Vendor
CVE Published:
18 August 2026

What is CVE-2026-71572?

A response header injection vulnerability exists within the Joomla! Core, specifically affecting versions 3.0.0 to 5.4.7 and 6.0.0 to 6.1.2. Due to insufficient output processing in the download views, an attacker could exploit this flaw by injecting malicious headers, leading to reflected file download and content-type confusion. This vulnerability poses significant risks as it allows the execution of unintended actions on behalf of the user.

Affected Version(s)

Joomla! CMS 3.0.0-5.4.6

Joomla! CMS 6.0.0-6.1.2

References

https://www.joomla.org/
product
https://developer.joomla.org/security-centre/1068-2026080...
vendor-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arib06
.