CVE-2026-73373

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

State: Published
Severity: 8.9 High
Published: Aug 18, 2026
Updated: Aug 19, 2026
Reserved: Aug 12, 2026

Description

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

Scores

CVSS	Score	Vector	Source
4.0	8.9 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	Joomla

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
Joomla! CMSJoomla! Project	1.0.0-5.4.6Affected 6.0.0-6.1.2Affected
Joomla! Framework Filesystem packageJoomla! Project	1.0.0-3.3.0Affected 4.0.0-4.2.0Affected

References

https://www.joomla.org/product
https://developer.joomla.org/security-centre/1077-20260810-core-unrestricted-uploads-of-shtml-files.htmlvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.