50 vulnerabilities · 41 with an official CVE
Joomla! 3 Security Vulnerabilities: The Complete CVE List
Joomla! 3 reached official end-of-life on 17 August 2023, and no more security updates come from the Joomla! Project. Since then, 50 vulnerabilities affecting the Joomla! 3 core have been identified and independently verified: 41 tied to an official CVE identifier, 9 additional hardening findings without a CVE. This page lists every one of them individually: CVE ID, vulnerability class, affected file, and how confident the finding is, so it's easy to search, cite, and check against your own site.
Last updated: 23.08.2026 · ← Back to the security patch
Vulnerabilities by class
| Class | Count |
|---|---|
| XSS / Cross-Site-Scripting | 24 |
| Access control / authentication | 9 |
| Other hardening | 4 |
| SQL injection | 2 |
| Cache poisoning | 2 |
| Timing attacks | 2 |
| File upload / RCE | 2 |
| Open redirect | 2 |
| Path traversal / LFI | 1 |
| PHP object injection | 1 |
| Information disclosure | 1 |
Every vulnerability, individually
| ID | Type | CVE | Class | File | Confidence |
|---|---|---|---|---|---|
| JP3-0001 | Security | CVE-2025-54476 | XSS filter bypass | InputFilter.php | High |
| JP3-0002 | Security | CVE-2025-63083 | Stored XSS | toc.php | High |
| JP3-0003 | Security | CVE-2026-21629 | Missing authentication check | ajax.php | High |
| JP3-0004 | Security | CVE-2026-48954 | Stored XSS (attribute-breakout) | languageoverridequotes.php +2 more | High |
| JP3-0005 | Security | CVE-2026-48950 | Reflected XSS | default.php | Medium |
| JP3-0006 | Security | CVE-2026-48953 | XSS via public layout API | image.php | Medium |
| JP3-0007 | Security | CVE-2026-48952 | XSS via untrusted update feed data | default.php | Medium |
| JP3-0008 | Security | CVE-2026-25901 | Stored XSS | edit.php | Medium |
| JP3-0009 | Security | CVE-2026-30894 | Stored XSS | preview.php | High |
| JP3-0010 | Security | CVE-2026-25900 | XSS via untrusted RSS feed | default.php +1 more | High |
| JP3-0011 | Security | CVE-2026-30895 | Stored XSS | readmore.php +1 more | Medium |
| JP3-0012 | Security | CVE-2026-40383 | Path traversal to local file inclusion | HtmlView.php | High |
| JP3-0013 | Security | CVE-2026-35222 | SQL injection | tags.php +1 more | High |
| JP3-0014 | Security | CVE-2026-48902 | Sensitive token sent over cleartext HTTP | reset.php +1 more | High |
| JP3-0015 | Security | CVE-2026-48901 | Cache poisoning / incorrect filter reuse | InputFilter.php | High |
| JP3-0016 | Security | CVE-2026-48948 | Broken access control | view.vcf.php | High |
| JP3-0017 | Security | CVE-2025-63082 | XSS via data: URI | InputFilter.php | High |
| JP3-0018 | Security | CVE-2024-40747 | XSS via module style/attribute parameters | ModuleHelper.php | High |
| JP3-0019 | Security | CVE-2025-25226 | SQL injection via identifier quoting bypass | driver.php | High |
| JP3-0020 | Security | CVE-2026-21631 | Stored XSS | edit.php | High |
| JP3-0021 | Security | — | Missing authorization check | update.php | High |
| JP3-0022 | Security | — | Timing side-channel | totp.php | High |
| JP3-0023 | Security | — | Missing request/response authentication | yubikey.php +3 more | High |
| JP3-0024 | Security | — | PHP object injection (defense-in-depth) | restore.php | Medium |
| JP3-0025 | Security | — | XSS via untrusted external feed | default.php | High |
| JP3-0026 | Security | — | Timing side-channel (limited real-world impact) | reset.php | Medium |
| JP3-0027 | Security | — | Code hygiene (eval removal) -- not found to be exploitable | HtmlDocument.php | Medium |
| JP3-0028 | Security | — | Remote code execution via file upload bypass | MediaHelper.php | High |
| JP3-0029 | Security | — | Content-type sniffing bypass (upload XSS) | MediaHelper.php | High |
| JP3-0030 | Security | CVE-2023-40626 | Information disclosure (env var / PHP constant exposure) | LanguageHelper.php +28 more | High |
| JP3-0031 | Security | CVE-2024-21723 | Open redirect | framework.php | High |
| JP3-0032 | Security | CVE-2024-27184 | Improper URL validation (open redirect / SSRF-adjacent) | Uri.php | High |
| JP3-0033 | Security | CVE-2024-21724 | XSS via unvalidated media-field value | banner.xml +28 more | High |
| JP3-0034 | Security | CVE-2024-26279 | XSS via malicious wrapper URL (javascript:/data: schemes) | default.xml +1 more | High |
| JP3-0035 | Security | CVE-2024-21726 | XSS filter gap in the URL form-validation rule | UrlRule.php +1 more | High |
| JP3-0036 | Security | CVE-2024-21731 | XSS via entity-encoded tag surviving strip_tags then getting decoded live | string.php | High |
| JP3-0037 | Security | CVE-2024-40743 | XSS via case-mixed or nested tag surviving a single-pass, case-sensitive strip regex | OutputFilter.php | High |
| JP3-0038 | Security | CVE-2024-27185 | Cache poisoning via arbitrary parameter injection into cached pagination links | Pagination.php | High |
| JP3-0039 | Security | CVE-2024-21722 | Insufficient session expiration after MFA method change | user.php +1 more | High |
| JP3-0040 | Security | CVE-2024-21725 | XSS via punycode-decoded email/URL containing HTML-special characters | default.php +7 more | Medium |
| JP3-0041 | Security | CVE-2024-26278 | Stored XSS via unsanitized custom-field default value | field.xml | High |
| JP3-0042 | Security | CVE-2024-27187 | Improper access control (self-service privilege/identity tampering) | user.php | Medium |
| JP3-0043 | Security | CVE-2026-48898 | Missing authorization check (defense-in-depth; does not close a currently-reachable 3.x gap) | user.php | Medium |
| JP3-0044 | Security | CVE-2026-73371 | Improper access control (batch-copy items the user cannot edit) | AdminModel.php +4 more | High |
| JP3-0045 | Security | CVE-2026-48956 | Missing authorization check (defense-in-depth for a non-standard entry point) | controller.php | Medium |
| JP3-0046 | Security | CVE-2026-71572 | HTTP header injection via unsanitized filename | view.raw.php +1 more | High |
| JP3-0047 | Security | CVE-2026-73373 | Remote code execution via file upload bypass (SSI-executable extension) | template.php | High |
| JP3-0048 | Security | CVE-2026-21632 | Stored XSS via unescaped article title | blog_links.php +6 more | High |
| JP3-0049 | Security | CVE-2024-40748 | XSS via unescaped HTML id attribute | default.php | High |
| JP3-0050 | Security | CVE-2024-40749 | Access control bypass via case-insensitive class resolution vs. case-sensitive ACL check | controller.php +1 more | High |
| JP3-0051 | PHP 8 | — | PHP 8.1 compatibility (Serializable interface deprecation notice, not a vulnerability) | Input.php +1 more | High |
| JP3-0052 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | Feed.php | High |
| JP3-0053 | PHP 8 | — | PHP 8.4 compatibility (implicit-nullable-parameter deprecation, not a vulnerability) | BaseApplication.php +6 more | High |
| JP3-0054 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | iterator.php | High |
| JP3-0055 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | iterator.php | High |
| JP3-0056 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | DataSet.php | High |
| JP3-0057 | PHP 8 | — | PHP 8.1 compatibility (SPL interface return-type deprecation, not a vulnerability) | Input.php | High |
CVE identifiers link to their official record in the National Vulnerability Database (NVD).
Methodology
Want these fixed on your site?
This is the same dataset behind our Joomla! 3 Security Patch: a one-click Scan & Apply tool that fixes all 50 of these on your own installation.
Get the Security Patch · $19.90