Intel

CVE-2026-48903

joomla: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVE-2026-48903)

mediumEPSS 0.2%

Affected

  • bitnami/joomla 3.0.0..*
  • bitnami/joomla 6.0.0..*

Description

Inadequate content filtering within the checkAttribute methods leads to XSS vulnerabilities in various components.

Source: BSI WID PortalBSI CSAFOSV (Open Source Vulnerabilities)cvelistv5NVD (NIST)ENISA EUVDCVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

bitnamijoomla
3.0.06.0.0

Metrics

XIEM Effective CVSS
6.9
Source: nvd-v4
EPSS percentile
14.4 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
55.13
Exploit maturity
no public PoC known
CVSS v3
6.1
CVSS v4
6.9
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-05-27 08:47 UTC
CWE
CWE-79

Weakness classes (CWE)

  • CWE-79Base

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

    cwe.mitre.org →

References & sources