CVE-2026-101111: Joomla Book Library XSS Vulnerability

CVE-2026-101111 Overview

CVE-2026-101111 is a reflected Cross-Site Scripting (XSS) vulnerability in the OrdaSoft Book Library (Free) extension for Joomla, affecting versions prior to 6.4.6. The public book-detail page template echoes the raw title request parameter directly into a double-quoted HTML attribute without any escaping. Attackers can craft a URL containing a double quote followed by arbitrary HTML or JavaScript, which executes in the victim's browser when the link is visited. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of the victim's session, enabling session hijacking, credential theft, and defacement of the affected Joomla site.

Affected Products

OrdaSoft Book Library (Free) Joomla extension, versions prior to 6.4.6
Joomla sites hosting the vulnerable site/views/view_book/tmpl/default.php template
Public-facing book-detail pages that accept the title request parameter

Discovery Timeline

2026-09-28 - CVE-2026-101111 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101111

Vulnerability Analysis

The vulnerability resides in the public book-detail page template at site/views/view_book/tmpl/default.php. The template renders the value of $_REQUEST["title"] directly into a double-quoted HTML attribute using echo $_REQUEST["title"]; without invoking any escaping or sanitization function. Because Joomla does not enforce output encoding at the template layer, the raw request parameter reaches the browser unchanged.

Exploitation requires the victim to click a crafted link, matching the User Interaction: Passive requirement in the CVSS vector. Once triggered, injected script executes with the origin and privileges of the vulnerable Joomla site.

Root Cause

The root cause is missing output encoding on user-controlled input. The template treats $_REQUEST["title"] as trusted content and interpolates it into an HTML attribute context. No calls to htmlspecialchars(), Joomla\CMS\Filter\OutputFilter::stringHTMLSafe(), or equivalent functions occur before echoing the value.

Attack Vector

An attacker constructs a URL that targets a book-detail page and supplies a malicious title parameter. A payload containing a double quote character terminates the surrounding HTML attribute early and introduces new attributes such as onmouseover or onload, or breaks out into a <script> tag. When a visitor loads the URL, the browser parses the injected markup and executes the attacker's JavaScript in the site's origin. Referenced technical details are available from the OrdaSoft Official Website.

Detection Methods for CVE-2026-101111

Indicators of Compromise

Web server access logs containing requests to Book Library book-detail routes with title parameters containing ", <, >, script, onerror, or onload tokens.
Outbound requests from user browsers to attacker-controlled domains immediately after loading a book-detail page.
Unexpected session cookie transmissions or credential submissions originating from the Joomla site's domain.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns in the title query parameter for URLs matching the Book Library component route.
Enable Content Security Policy (CSP) reporting to identify inline script execution attempts on book-detail pages.
Correlate anomalous outbound HTTP calls from client browsers with prior requests to Book Library URLs in web analytics or SIEM data.

Monitoring Recommendations

Ingest Joomla and reverse proxy logs into a centralized analytics platform and alert on request parameters containing HTML metacharacters.
Monitor Joomla extension inventories for installations of Book Library below version 6.4.6.
Track referrer chains showing external sources delivering users to book-detail URLs with encoded script payloads.

How to Mitigate CVE-2026-101111

Immediate Actions Required

Upgrade the OrdaSoft Book Library (Free) extension to version 6.4.6 or later on all Joomla installations.
Audit web logs for prior exploitation attempts targeting the title parameter and review affected user sessions.
Rotate administrator session tokens and force re-authentication if suspicious requests are found.

Patch Information

OrdaSoft addresses this issue in Book Library version 6.4.6. Refer to the OrdaSoft Official Website for the updated extension package and release notes.

Workarounds

Temporarily disable the Book Library component in the Joomla administrator panel until the patched version is installed.
Apply a WAF rule that blocks or sanitizes requests to the view_book view when the title parameter contains ", <, or > characters.
Enforce a strict Content Security Policy that disallows inline script execution on Joomla frontend pages.

bash

# Example ModSecurity rule to block XSS payloads in the title parameter
SecRule ARGS:title "@rx [\"<>]|(?:script|onerror|onload)" \
    "id:1010111,phase:2,deny,status:403,log,msg:'Blocked reflected XSS attempt against Book Library (CVE-2026-101111)'"