Arbitrary file upload in Joomla! Project Cms
CVE-2026-73373
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
Vulnerability class: Unrestricted File Upload
Affected products
- Joomla! Project Cms — versions 1.0.0-5.4.6, 6.0.0-6.1.2
- Joomla! Project Framework Filesystem Package — versions 1.0.0-3.3.0, 4.0.0-4.2.0
Weakness classification (CWE)
References
- security@joomla.org
- security@joomla.org (product)
- security@joomla.org (vendor-advisory)