Joomla: 25 Vulnerabilities Including Critical RCE and SQLi Disclosed Together
A batch of 25 vulnerabilities, including critical RCE and SQLi, were disclosed for Joomla core and extensions from Sept 28-30, 2026, affecting versions up to 6.1.3.
Key findings
- 25 vulnerabilities disclosed in Joomla core and extensions between Sept 28-30, 2026, including critical RCE and SQLi.
- Unauthenticated RCE in OrdaSoft CCK (CVE-2026-102427) and SQLi in OrdaSoft Book Library/Vehicle Manager (CVE-2026-101110, CVE-2026-101108) are critical threats.
- Multiple XSS vulnerabilities affect core Joomla and extensions like Balbooa Forms and OrdaSoft Book Library.
- Flaws include MFA bypass, improper ACL checks, arbitrary directory deletion, and LFI/SSRF across various components.
- Affected versions range from Joomla 1.5.0 to 6.1.3; immediate patching is recommended.
On September 28, 2026, a significant batch of 25 vulnerabilities was disclosed across various Joomla extensions and core components, spanning a disclosure window from September 28 to September 30, 2026. This coordinated disclosure event highlights critical security weaknesses, including unauthenticated Remote Code Execution (RCE), SQL Injection (SQLi), Cross-Site Scripting (XSS), and authentication bypass flaws. The vulnerabilities affect multiple third-party extensions, including those from OrdaSoft, Balbooa, and Regular Labs, as well as Joomla's core functionalities.
Several critical vulnerabilities were detailed, most notably CVE-2026-102427, an unauthenticated RCE flaw in OrdaSoft CCK versions prior to 8.3.16. This vulnerability is particularly concerning as it allows attackers to execute arbitrary code on a vulnerable system without prior authentication by exploiting a file upload handler.
SQL Injection vulnerabilities were also prominent, with CVE-2026-101110 and CVE-2026-101108 from OrdaSoft's Book Library (Free) and Vehicle Manager (Free) respectively. These flaws allow unauthenticated attackers to manipulate database queries, potentially leading to data theft or modification. CVE-2026-101109, also from OrdaSoft, presents Server-Side Request Forgery (SSRF) vectors due to improper validation of URLs used in server-side requests.
Cross-Site Scripting (XSS) vulnerabilities were found in both core Joomla components and third-party extensions. CVE-2026-92232 and CVE-2026-92231 demonstrate XSS filter bypasses in Joomla's core InputFilter, while CVE-2026-92225, CVE-2026-92224, CVE-2026-90914, and CVE-2026-90906 highlight XSS issues in various core layouts and helpers. Additionally, CVE-2026-101111 (Balbooa Forms) and CVE-2026-101101 (OrdaSoft Book Library) are examples of XSS vulnerabilities in extensions.
Beyond RCE, SQLi, and XSS, other significant vulnerabilities include an MFA authentication bypass via rememberme cookies (CVE-2026-92227) and improper ACL checks in various core edit and access tasks (CVE-2026-92226, CVE-2026-92223, CVE-2026-90917, CVE-2026-90916, CVE-2026-90915). CVE-2026-90913, an arbitrary directory deletion flaw via the cache purge action, also presents a significant risk. CVE-2026-101111 from Balbooa Forms allows unauthorized deletion of attachments. CVE-2026-100750 from Regular Labs' Modules Anywhere involves LFI/SSRF vulnerabilities.
The affected versions span a wide range, from older Joomla versions (1.5.0) up to the latest releases (e.g., Joomla 6.1.3). Patches and updates are available for most of these vulnerabilities, with vendors urging immediate application. Users are strongly advised to consult the specific advisories for each affected extension and Joomla core to ensure their systems are updated to secure versions.
This large batch of vulnerabilities underscores the importance of diligent security practices for Joomla users, including regular updates of both the core CMS and all installed extensions. The presence of unauthenticated RCE and SQLi flaws, in particular, poses a severe risk, potentially allowing for complete system compromise.
The disclosure event, which saw a significant number of vulnerabilities reported on September 28-30, 2026, highlights the ongoing efforts by security researchers to uncover and report weaknesses in popular platforms like Joomla. Staying informed about these disclosures and applying patches promptly is crucial for maintaining the security and integrity of Joomla-powered websites. ,cve_ids:[