PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-30894 Joomla! Project CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in the content history component of Joomla! Core. The flaw stems from insufficient output escaping, allowing an attacker with high privileges to inject malicious scripts that execute in the context of another user's browser session. The vulnerability was disclosed by the Joomla! Security Strike Team and is currently undergoing analysis in the National Vulnerability Database.

Vendor
Joomla! Project
Product
Joomla! CMS
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-27
Advisory published
2026-05-26
Advisory updated
2026-05-27

Who should care

Joomla! site administrators, security teams managing Joomla! deployments, and developers extending the content history functionality

Technical summary

The vulnerability exists in Joomla!'s com_contenthistory component due to missing output escaping. An authenticated attacker with high privileges can inject malicious payloads into content history data. When another user with appropriate permissions views the affected history entries, the injected scripts execute in their browser context. The CVSS 4.0 score of 6.9 (Medium) reflects the high privilege requirement and user interaction needed for exploitation, though successful exploitation yields high confidentiality impact.

Defensive priority

medium

Recommended defensive actions

  • Apply security updates from the Joomla! project when available, referencing the official security advisory
  • Review and restrict administrative access to the content history component
  • Implement Content Security Policy (CSP) headers to mitigate XSS impact
  • Audit content history entries for suspicious script injection patterns
  • Enable output encoding and context-aware escaping in custom extensions interacting with com_contenthistory

Evidence notes

The vulnerability is attributed to Joomla! based on the security advisory reference provided in the NVD record. The CVSS 4.0 vector indicates network attack vector with low attack complexity, requiring high privileges and user interaction.

Official resources

2026-05-26