PatchSiren cyber security CVE debrief

CVE-2026-48901 Joomla! Project CVE debrief

CVE-2026-48901 describes a vulnerability in the `InputFilter::getInstance()` method where a security-sensitive parameter was omitted from the instance cache key construction. This flaw could allow improper cache reuse across different security contexts, potentially leading to security boundary violations in input filtering operations. The vulnerability was published on 2026-05-26 and is currently undergoing analysis in the NVD. The affected product is Joomla, based on the security advisory reference from the Joomla Security Centre. No CVSS score or severity rating has been assigned at this time. The issue has not been added to CISA's Known Exploited Vulnerabilities catalog.

Vendor: Joomla! Project
Product: Joomla! CMS
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-26
Original CVE updated: 2026-05-26
Advisory published: 2026-05-26
Advisory updated: 2026-05-26

Who should care

Joomla site administrators, particularly those running multi-site installations or shared hosting environments; security teams managing Joomla-based web applications; developers of Joomla extensions that rely on custom InputFilter configurations

Technical summary

The `InputFilter::getInstance()` method in Joomla constructs a cache key to reuse InputFilter instances. A security-sensitive parameter was inadvertently excluded from this cache key calculation, meaning that instances created with different security parameters could be incorrectly reused from cache. This could result in input filtering being applied with incorrect security rules—potentially allowing more permissive filtering than intended, or conversely blocking legitimate input. The vulnerability affects the integrity of security context separation in Joomla's input sanitization layer.

Defensive priority

medium

Recommended defensive actions

Review Joomla security advisory 20260517 for detailed technical information and affected versions
Apply security updates from Joomla when available, prioritizing systems with multi-tenant or shared hosting configurations where InputFilter context separation is critical
Audit custom extensions or integrations that directly invoke InputFilter::getInstance() with custom security parameters
Monitor NVD entry for CVSS scoring and updated analysis once completed
Review application logs for unexpected InputFilter behavior or cache-related anomalies

Evidence notes

The vulnerability description indicates incorrect cache key construction in `InputFilter::getInstance()`, which is a core Joomla security component. The reference to developer.joomla.org/security-centre/1049-20260517-core-incorrect-cache-key-construction-for-inputfilter-objects.html confirms this is a Joomla core issue. The NVD status shows 'Undergoing Analysis' as of the last modification timestamp.

Official resources

2026-05-26