59 vulnerabilities · 50 with an official CVE
Joomla! 3 Security Vulnerabilities: The Complete CVE List
Joomla! 3 reached official end-of-life on 17 August 2023, and no more security updates come from the Joomla! Project. Since then, 59 vulnerabilities affecting the Joomla! 3 core have been identified and independently verified: 50 tied to an official CVE identifier, 9 additional hardening findings without a CVE. This page lists every one of them individually: CVE ID, vulnerability class, affected file, and how confident the finding is, so it's easy to search, cite, and check against your own site.
Last updated: 23.08.2026 · ← Back to the security patch
Vulnerabilities by class
| Class | Count |
|---|---|
| XSS / Cross-Site-Scripting | 28 |
| Access control / authentication | 12 |
| Other hardening | 4 |
| SQL injection | 2 |
| Cache poisoning | 2 |
| Timing attacks | 2 |
| File upload / RCE | 2 |
| Open redirect | 2 |
| Path traversal / LFI | 2 |
| PHP object injection | 1 |
| Information disclosure | 1 |
| SSRF (Server-Side Request Forgery) | 1 |
Every vulnerability, individually
| ID | Type | CVE | Class | File | Confidence |
|---|---|---|---|---|---|
| JP3-0001 | Security | CVE-2025-54476 | XSS filter bypass | InputFilter.php | High |
| JP3-0002 | Security | CVE-2025-63083 | Stored XSS | toc.php | High |
| JP3-0003 | Security | CVE-2026-21629 | Missing authentication check | ajax.php | High |
| JP3-0004 | Security | CVE-2026-48954 | Stored XSS (attribute-breakout) | languageoverridequotes.php +2 more | High |
| JP3-0005 | Security | CVE-2026-48950 | Reflected XSS | default.php | Medium |
| JP3-0006 | Security | CVE-2026-48953 | XSS via public layout API | image.php | Medium |
| JP3-0007 | Security | CVE-2026-48952 | XSS via untrusted update feed data | default.php | Medium |
| JP3-0008 | Security | CVE-2026-25901 | Stored XSS | edit.php | Medium |
| JP3-0009 | Security | CVE-2026-30894 | Stored XSS | preview.php | High |
| JP3-0010 | Security | CVE-2026-25900 | XSS via untrusted RSS feed | default.php +1 more | High |
| JP3-0011 | Security | CVE-2026-30895 | Stored XSS | readmore.php +1 more | Medium |
| JP3-0012 | Security | CVE-2026-40383 | Path traversal to local file inclusion | HtmlView.php | High |
| JP3-0013 | Security | CVE-2026-35222 | SQL injection | tags.php +1 more | High |
| JP3-0014 | Security | CVE-2026-48902 | Sensitive token sent over cleartext HTTP | reset.php +1 more | High |
| JP3-0015 | Security | CVE-2026-48901 | Cache poisoning / incorrect filter reuse | InputFilter.php | High |
| JP3-0016 | Security | CVE-2026-48948 | Broken access control | view.vcf.php | High |
| JP3-0017 | Security | CVE-2025-63082 | XSS via data: URI | InputFilter.php | High |
| JP3-0018 | Security | CVE-2024-40747 | XSS via module style/attribute parameters | ModuleHelper.php | High |
| JP3-0019 | Security | CVE-2025-25226 | SQL injection via identifier quoting bypass | driver.php | High |
| JP3-0020 | Security | CVE-2026-21631 | Stored XSS | edit.php | High |
| JP3-0021 | Security | — | Missing authorization check | update.php | High |
| JP3-0022 | Security | — | Timing side-channel | totp.php | High |
| JP3-0023 | Security | — | Missing request/response authentication | yubikey.php +3 more | High |
| JP3-0024 | Security | — | PHP object injection (defense-in-depth) | restore.php | Medium |
| JP3-0025 | Security | — | XSS via untrusted external feed | default.php | High |
| JP3-0026 | Security | — | Timing side-channel (limited real-world impact) | reset.php | Medium |
| JP3-0027 | Security | — | Code hygiene (eval removal) -- not found to be exploitable | HtmlDocument.php | Medium |
| JP3-0028 | Security | — | Remote code execution via file upload bypass | MediaHelper.php | High |
| JP3-0029 | Security | — | Content-type sniffing bypass (upload XSS) | MediaHelper.php | High |
| JP3-0030 | Security | CVE-2023-40626 | Information disclosure (env var / PHP constant exposure) | LanguageHelper.php +28 more | High |
| JP3-0031 | Security | CVE-2024-21723 | Open redirect | framework.php | High |
| JP3-0032 | Security | CVE-2024-27184 | Improper URL validation (open redirect / SSRF-adjacent) | Uri.php | High |
| JP3-0033 | Security | CVE-2024-21724 | XSS via unvalidated media-field value | banner.xml +28 more | High |
| JP3-0034 | Security | CVE-2024-26279 | XSS via malicious wrapper URL (javascript:/data: schemes) | default.xml +1 more | High |
| JP3-0035 | Security | CVE-2024-21726 | XSS filter gap in the URL form-validation rule | UrlRule.php +1 more | High |
| JP3-0036 | Security | CVE-2024-21731 | XSS via entity-encoded tag surviving strip_tags then getting decoded live | string.php | High |
| JP3-0037 | Security | CVE-2024-40743 | XSS via case-mixed or nested tag surviving a single-pass, case-sensitive strip regex | OutputFilter.php | High |
| JP3-0038 | Security | CVE-2024-27185 | Cache poisoning via arbitrary parameter injection into cached pagination links | Pagination.php | High |
| JP3-0039 | Security | CVE-2024-21722 | Insufficient session expiration after MFA method change | user.php +1 more | High |
| JP3-0040 | Security | CVE-2024-21725 | XSS via punycode-decoded email/URL containing HTML-special characters | default.php +7 more | Medium |
| JP3-0041 | Security | CVE-2024-26278 | Stored XSS via unsanitized custom-field default value | field.xml | High |
| JP3-0042 | Security | CVE-2024-27187 | Improper access control (self-service privilege/identity tampering) | user.php | Medium |
| JP3-0043 | Security | CVE-2026-48898 | Missing authorization check (defense-in-depth; does not close a currently-reachable 3.x gap) | user.php | Medium |
| JP3-0044 | Security | CVE-2026-73371 | Improper access control (batch-copy items the user cannot edit) | AdminModel.php +4 more | High |
| JP3-0045 | Security | CVE-2026-48956 | Missing authorization check (defense-in-depth for a non-standard entry point) | controller.php | Medium |
| JP3-0046 | Security | CVE-2026-71572 | HTTP header injection via unsanitized filename | view.raw.php +1 more | High |
| JP3-0047 | Security | CVE-2026-73373 | Remote code execution via file upload bypass (SSI-executable extension) | template.php | High |
| JP3-0048 | Security | CVE-2026-21632 | Stored XSS via unescaped article title | blog_links.php +6 more | High |
| JP3-0049 | Security | CVE-2024-40748 | XSS via unescaped HTML id attribute | default.php | High |
| JP3-0050 | Security | CVE-2024-40749 | Access control bypass via case-insensitive class resolution vs. case-sensitive ACL check | controller.php +1 more | High |
| JP3-0051 | PHP 8 | — | PHP 8.1 compatibility (Serializable interface deprecation notice, not a vulnerability) | Input.php +1 more | High |
| JP3-0052 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | Feed.php | High |
| JP3-0053 | PHP 8 | — | PHP 8.4 compatibility (implicit-nullable-parameter deprecation, not a vulnerability) | BaseApplication.php +6 more | High |
| JP3-0054 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | iterator.php | High |
| JP3-0055 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | iterator.php | High |
| JP3-0056 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | DataSet.php | High |
| JP3-0057 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | Input.php | High |
| JP3-0058 | Security | CVE-2026-92231 | XSS filter bypass via HTML5 named entities | InputFilter.php | High |
| JP3-0059 | Security | CVE-2026-90915 | Path traversal (arbitrary directory deletion via cache purge) | FileStorage.php | High |
| JP3-0060 | Security | CVE-2026-92222 | SSRF via unrestricted URL scheme in the feed fetch | FeedFactory.php +3 more | Medium |
| JP3-0061 | Security | CVE-2026-90907 | Missing authentication check (account creation by guests) | profile.php | Medium |
| JP3-0062 | Security | CVE-2026-90916 | Improper access control (content history comparison) | compare.php | High |
| JP3-0063 | Security | CVE-2026-90917 | Improper access control (category access level ignored in tagged items) | TagsHelper.php | High |
| JP3-0064 | Security | CVE-2026-92225 | Stored XSS via unescaped module position | default.php | High |
| JP3-0065 | Security | CVE-2026-90906 | Unescaped output in the HTML link helper (defense-in-depth) | HTMLHelper.php | Medium |
| JP3-0066 | Security | CVE-2026-92224 | Unescaped output in the toolbar link layout (defense-in-depth) | link.php | Medium |
CVE identifiers link to their official record in the National Vulnerability Database (NVD).
Methodology
Want these fixed on your site?
This is the same dataset behind our Joomla! 3 Security Patch: a one-click Scan & Apply tool that fixes all 59 of these on your own installation.
Get the Security Patch · $19.90Frequently asked questions
Why do some entries have no CVE number?
Not every vulnerability gets a formal CVE identifier assigned. These entries are still independently verified findings, listed with a dash where no CVE exists, exactly as the table shows.
Does this list only cover the Joomla! core, or extensions too?
Core only. This is specifically the Joomla! 3 core, the same code every Joomla! 3 site runs regardless of which extensions are installed. Extension vulnerabilities are a separate, much larger and site-specific list.
Will this list grow over time?
It can. Joomla! 3 no longer gets official fixes, but new vulnerabilities are still occasionally identified in code it shares with newer Joomla! versions. This page is updated when that happens.
How was each entry verified?
Each is checked against the actual Joomla! 3 core source, not just copied from a public advisory description, which is why some entries carry a confidence rating of Medium rather than High.