PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35222 Joomla! Project CVE debrief

## Summary CVE-2026-35222 is a SQL injection vulnerability in the `com_tags` component of Joomla! CMS. The flaw stems from improperly validated `order` clauses, allowing authenticated attackers to manipulate SQL queries. The vulnerability is rated **MEDIUM** severity with a CVSS score of **6.9** (CVSS 4.0 vector: `AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N`). ## Affected Product - **Vendor:** Joomla! (identified via security advisory domain) - **Component:** `com_tags` (Joomla! core tags component) - **Attack Vector:** Network-based, requires **high privileges** (authenticated access) ## Technical Details The vulnerability is classified as **CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')**. The Joomla! security advisory identifies this as an **authenticated blind SQL injection** issue in the core `com_tags` component. The flaw specifically involves insufficient validation of `order` clause parameters, which can be exploited by authenticated users to inject arbitrary SQL commands. The blind nature of the injection suggests attackers can infer database contents through boolean-based or time-based techniques without direct error messages. ## Timeline | Date | Event | |------|-------| | **2026-05-26 17:16:35 UTC** | CVE published by NVD | | **2026-05-26 19:06:58 UTC** | CVE record modified | The vulnerability was disclosed by Joomla! as security advisory **20260507** prior to CVE assignment. ## Risk Assessment - **Exploitability:** Moderate — requires authenticated access with elevated privileges - **Impact:** High confidentiality impact (`VC:H`), no direct integrity or availability impact per CVSS 4.0 scoring - **CISA KEV:** Not listed ## Recommended Actions 1. **Immediate:** Apply Joomla! security update for advisory 20260507 when available 2. **Verification:** Confirm `com_tags` component is updated to patched version 3. **Monitoring:** Review access logs for unusual `order` parameter patterns in `com_tags` requests 4. **Defense in depth:** Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in ordering parameters ## References - CVE.org official record - NVD vulnerability entry

Vendor
Joomla! Project
Product
Joomla! CMS
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-27
Advisory published
2026-05-26
Advisory updated
2026-05-27

Who should care

Joomla! site administrators, web application security teams, CMS security auditors

Technical summary

Authenticated blind SQL injection in Joomla! core com_tags component. Improper validation of order clause parameters allows high-privilege attackers to extract database contents. CVSS 4.0: 6.9 (MEDIUM).

Defensive priority

high

Recommended defensive actions

  • Apply Joomla! security update for advisory 20260507 when available
  • Confirm com_tags component is updated to patched version
  • Review access logs for unusual order parameter patterns in com_tags requests
  • Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in ordering parameters

Evidence notes

Vendor identification based on reference domain developer.joomla.org; confidence marked low per source corpus due to 'Unknown Vendor' classification in input data. CVSS vector and CWE-89 classification sourced from NVD record. Advisory number 20260507 extracted from Joomla! security centre URL path.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35222 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35222

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35222 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35222

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.