CVE-2026-102778: Joomla Event Gallery XSS Vulnerability

CVE-2026-102778 Overview

CVE-2026-102778 is a cross-site scripting (XSS) and open redirect vulnerability in the Event Gallery extension for Joomla, developed by svenbluege.de. The flaw exists in the share mini page of the front end in versions prior to 6.6.0. When the "Share article links" option is enabled, the extension reads the article address from the shared link and writes it into the page without sanitization or escaping. With the link type set to "Image Page with Redirect", the extension follows the attacker-supplied address automatically. A crafted link can execute script in the visitor's session or redirect the visitor to an attacker-controlled site.

Critical Impact
A prepared share link can run arbitrary JavaScript in the victim's browser session or send the visitor to an attacker-controlled destination without server-side state changes.

Affected Products

Joomla Event Gallery extension by svenbluege.de
Versions prior to 6.6.0
Deployments with the "Share article links" option enabled

Discovery Timeline

2026-10-05 - CVE-2026-102778 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-102778

Vulnerability Analysis

The vulnerability resides in the share mini page component of the Event Gallery extension front end. When a visitor opens a shared image link, the page can display a link back to the article the image was shared from. The extension takes the article address directly from the shared URL parameters and injects it into the rendered page without input validation or output escaping. This produces a reflected XSS condition tied to attacker-controlled URL input. The flaw is tracked under [CWE-352], and user interaction is required because the victim must click a crafted link.

Root Cause

The root cause is missing input sanitization and output encoding on a user-controlled URL parameter. The share mini page trusts the article address supplied in the shared link and writes it directly into the HTML response. When the link type is set to Image Page with Redirect, the extension additionally performs a client-side navigation to that unvalidated address, producing an open redirect primitive on top of the reflected XSS.

Attack Vector

An attacker crafts a malicious share link containing JavaScript payloads or an arbitrary external URL in the article address field. The attacker distributes the link through email, chat, or social media. When a victim opens the link in a vulnerable Joomla site, the share mini page renders the unescaped value, triggering script execution in the victim's browser context. With the "Image Page with Redirect" link type, the browser silently navigates to the attacker-controlled destination, enabling phishing or malware delivery. Server-side data is not read or modified by the attack.

No verified proof-of-concept code is published. See the Sven Bluege Personal Website for extension details and vendor contact.

Detection Methods for CVE-2026-102778

Indicators of Compromise

Web server access logs showing requests to the Event Gallery share mini page with suspicious URL parameters containing <script>, javascript:, onerror=, or encoded variants.
Outbound redirects from the Joomla site to unexpected third-party domains originating from share mini page navigation.
Referrer headers in downstream logs showing visitors arriving from the share mini page followed by anomalous destinations.

Detection Strategies

Deploy a web application firewall rule that inspects query parameters sent to Event Gallery share endpoints for script tags, event handlers, and non-whitelisted URL schemes.
Correlate browser-side script execution alerts with HTTP referrers pointing to the Joomla Event Gallery share mini page.
Review Joomla access logs for repeated requests to share pages carrying encoded payloads from the same source IP.

Monitoring Recommendations

Enable verbose logging on the Joomla front end and forward request logs to a centralized SIEM for query-parameter analysis.
Alert on HTTP 3xx responses originating from Event Gallery URLs that redirect outside the site's own domain.
Monitor Content Security Policy (CSP) violation reports for inline script execution on gallery pages.

How to Mitigate CVE-2026-102778

Immediate Actions Required

Upgrade the Event Gallery extension to version 6.6.0 or later on all Joomla installations.
If immediate patching is not possible, disable the "Share article links" option in the Event Gallery configuration.
Avoid using the "Image Page with Redirect" link type until the extension is updated.

Patch Information

The vendor has resolved the issue in Event Gallery 6.6.0. Administrators should download the current release from the vendor via the Sven Bluege Personal Website and apply it through the Joomla Extensions Manager. Verify the installed version in the Joomla administrator console after upgrade.

Workarounds

Disable the share article links feature in the Event Gallery extension settings to remove the vulnerable code path.
Switch any configured link type away from "Image Page with Redirect" to prevent automatic navigation to attacker-controlled URLs.
Enforce a strict Content Security Policy on the Joomla site that blocks inline script execution and restricts navigation to allow-listed domains.

bash

# Example strict Content Security Policy header for Apache (.htaccess)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"