PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35221 Joomla! Project CVE debrief

A SQL injection vulnerability exists in the Joomla com_finder component due to improperly constructed filter clauses in search queries. The vulnerability requires authenticated access and has been assigned a CVSS 4.0 score of 6.9 (MEDIUM severity). The issue was disclosed by the Joomla Security Centre on May 6, 2026, and subsequently published in the NVD on May 26, 2026. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Vendor
Joomla! Project
Product
Joomla! CMS
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-27
Advisory published
2026-05-26
Advisory updated
2026-05-27

Who should care

Organizations running Joomla installations with the com_finder component enabled, particularly those with multiple authenticated users or exposed administrative interfaces. Security teams responsible for content management system security and database protection should prioritize assessment and patching.

Technical summary

The com_finder component in Joomla fails to properly construct filter clauses in search queries, resulting in a blind SQL injection vulnerability. Exploitation requires authenticated access with high privileges. Successful exploitation could result in unauthorized disclosure of sensitive information from the database. The vulnerability does not appear to affect system integrity or availability based on the CVSS vector.

Defensive priority

medium

Recommended defensive actions

  • Apply security updates from Joomla when available per the vendor security advisory
  • Review and restrict access to com_finder administrative functions to trusted users only
  • Implement Web Application Firewall (WAF) rules to detect and block SQL injection attempts against com_finder endpoints
  • Monitor database query logs for anomalous patterns indicative of SQL injection exploitation
  • Conduct security assessment of custom extensions interacting with com_finder search functionality

Evidence notes

The vulnerability is documented in the Joomla Security Centre advisory and tracked in NVD with status 'Undergoing Analysis'. The CVSS 4.0 vector indicates network attack vector, low attack complexity, high privileges required, and high confidentiality impact with no integrity or availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35221 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35221

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35221 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35221

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.