CVE-2026-23900: Phoca Maps XSS Vulnerability

CVE-2026-23900 Overview

CVE-2026-23900 affects the Phoca Maps component versions 5.0.0 through 6.0.2. The vulnerability consists of multiple stored Cross-Site Scripting (XSS) flaws in the map and icon rendering logic. Attackers can inject persistent JavaScript payloads that execute in the browsers of users viewing affected map content. The flaw is classified under [CWE-79], improper neutralization of input during web page generation.

Critical Impact

Authenticated or content-contributing attackers can store malicious scripts in Phoca Maps data, executing arbitrary JavaScript in visitor browsers and enabling session theft, defacement, or redirection to attacker-controlled sites.

Affected Products

• Phoca Maps component 5.0.0
• Phoca Maps component versions 5.x through 6.0.1
• Phoca Maps component 6.0.2

Discovery Timeline

• 2026-04-11 - CVE CVE-2026-23900 published to NVD
• 2026-04-17 - Last updated in NVD database

Technical Details for CVE-2026-23900

Vulnerability Analysis

The Phoca Maps component is a Joomla extension that renders interactive maps with custom markers and icons. The vulnerability resides in the rendering logic that processes user-supplied map metadata and icon attributes. The component fails to neutralize HTML and JavaScript control characters before embedding stored values into rendered output.

Because the payload is persisted server-side, every visitor who loads the affected map page triggers execution of the injected script. This expands the impact beyond a single victim to all viewers of the affected resource. Stored XSS in a Joomla extension can be leveraged to hijack administrator sessions when an admin previews or manages the affected content.

Root Cause

The root cause is missing output encoding and inadequate input sanitization in the map and icon rendering routines. User-controlled fields used to construct marker metadata, icon references, or popup content are concatenated into HTML without contextual escaping. This permits attribute-breakout and script-tag injection within the rendered map markup.

Attack Vector

An attacker with privileges to create or edit Phoca Maps entries submits a payload containing HTML or JavaScript through a vulnerable field. The component stores the payload and later serves it inside the map rendering output. Any user, including unauthenticated visitors, who loads the map page executes the attacker's script in the context of the hosting Joomla site.

No verified public exploit code is available for CVE-2026-23900. Refer to the Phoca Security Information page for vendor-published technical details.

Detection Methods for CVE-2026-23900

Indicators of Compromise

• Unexpected <script> tags, on* event handlers, or javascript: URIs stored in Phoca Maps database tables, particularly within marker, icon, or description fields.
• Outbound requests from visitor browsers to unfamiliar domains immediately after loading pages that embed a Phoca Maps component.
• Joomla administrator sessions exhibiting unauthorized configuration changes shortly after viewing map content.

Detection Strategies

• Audit Phoca Maps database records for HTML control characters and script payloads in stored map, marker, and icon metadata fields.
• Monitor web server access logs for POST requests to Phoca Maps administrative endpoints containing encoded <, >, or script tokens.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from map-rendering pages.

Monitoring Recommendations

• Enable Joomla action logging for the Phoca Maps component and review changes made by content contributors.
• Alert on browser console errors and CSP violation reports tied to URLs that render Phoca Maps content.
• Track anomalous administrator session activity following visits to pages containing user-contributed maps.

How to Mitigate CVE-2026-23900

Immediate Actions Required

• Upgrade Phoca Maps to a release later than 6.0.2 once the vendor publishes a fixed version.
• Restrict permissions for creating and editing Phoca Maps content to trusted users only.
• Review existing map entries for malicious payloads and sanitize or remove suspicious records.

Patch Information

Consult the Phoca Security Information page for the official advisory and patched release information. Apply the vendor-supplied update to all Joomla installations using Phoca Maps versions 5.0.0 through 6.0.2.

Workarounds

• Disable the Phoca Maps component on public-facing pages until a patched version is installed.
• Deploy a strict Content Security Policy that disallows inline scripts on pages rendering Phoca Maps output.
• Place a Web Application Firewall (WAF) rule in front of the Joomla administrator interface to block requests containing script tags in Phoca Maps parameters.

# Configuration example: restrictive CSP header for pages rendering Phoca Maps
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"