XSS Vulnerability in Joomla! Core Affecting Multiple Versions

CVE-2026-90906

What is CVE-2026-90906?

A Cross-Site Scripting (XSS) vulnerability has been identified in the HTMLHelper::link method of Joomla! Core. This flaw affects multiple versions of Joomla, allowing attackers to inject malicious scripts into the HTML output. The lack of proper escaping means that untrusted input can be executed in users' browsers, potentially compromising user data and session cookies. It is crucial for Joomla users to apply the latest security updates to mitigate this risk, as the vulnerability poses significant security concerns for web applications utilizing the affected frameworks.

References