CVE-2026-88855 OrdaSoft.com CVE debrief

Who should care

Joomla site administrators, security teams, and users with core.manage permissions should assess exposure, prioritize remediation, and monitor database activity. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed

Why it matters

CVE-2026-88855 is a high-severity vulnerability in the OrdaSoft Joomla Gallery extension that allows authenticated users to inject SQL, potentially leading to unauthorized database access and data extraction. Joomla site administrators and security teams should assess exposure, prioritize remediation, and monitor database activity.

• Potential unauthorized database access
• Possible extraction of sensitive data, including password hashes
• Required verification of affected versions and remediation status
• Necessity for monitoring database activity for suspicious queries

Technical summary

The OrdaSoft Joomla Gallery extension for Joomla versions less than 6.2.7 is vulnerable to SQL injection due to improper sanitization of user input in the saveGallery() function. The function fails to properly sanitize SQL content from user input, specifically from category_names[], catOrderIds, and image-ordering fields. These values are concatenated directly into SQL queries with no quoting or integer cast, giving an authenticated core.manage user full read/write access to the database, including UNION-based extraction of #__users password hashes.

Defensive priority

High priority for Joomla site administrators and security teams

Recommended defensive actions

• Update the OrdaSoft Joomla Gallery extension to version 6.2.7 or later
• Restrict core.manage permissions to trusted users
• Monitor database activity for suspicious queries
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the saveGallery() function of the OrdaSoft Joomla Gallery extension. The function fails to properly sanitize SQL content from user input, specifically from category_names[], catOrderIds, and image-ordering fields. These values are concatenated directly into SQL queries with no quoting or integer cast, giving an authenticated core.manage user full read/write access to the database. The saveGallery() function passes form data through a hand-rolled parser into Joomla's Input object, then reads it back with the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.