Unrestricted File Upload Vulnerability in Joomla! Core by Joomla
CVE-2026-73373

8.9HIGH

Key Information:

Vendor

Joomla
Status
Joomla! Cms
Joomla! Framework Filesystem Package
Vendor
CVE Published:
18 August 2026

What is CVE-2026-73373?

An issue in Joomla! Core allows for unrestricted uploads of SHTML files, impacting versions 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2. This vulnerability arises because the default configuration fails to classify SHTML files as dangerous. When hosted on servers that execute such files, this oversight can lead to arbitrary code execution, potentially compromising the server's security.

Affected Version(s)

Joomla! CMS 1.0.0-5.4.6

Joomla! CMS 6.0.0-6.1.2

Joomla! Framework Filesystem package 1.0.0-3.3.0

References

https://www.joomla.org/
product
https://developer.joomla.org/security-centre/20260810-cor...
vendor-advisory

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.