Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Why this deserves its current priority

CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Joomla! Project/Joomla! CMS (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Joomla! Project/Joomla! CMS.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 29, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 29, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 29, 2026

Sources and claim methodology

• Source referencedeveloper.joomla.org
• Source referencejoomla.org

Related CVEs

• Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationAlso CWE-79
• Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for DatabasesSame generic ecosystem
• MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB DeserializationSame generic ecosystem
• Electron: Sandboxed preload code cache can be poisoned by a compromised rendererSame generic ecosystem
• mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packetSame generic ecosystem
• CISA ADP VulnrichmentSame generic ecosystem