CVE-2026-30895: Joomla! com_content XSS Vulnerability

CVE-2026-30895 Overview

CVE-2026-30895 is a stored cross-site scripting (XSS) vulnerability in Joomla! affecting the com_content core component. The flaw stems from missing output escaping in readmore links, allowing attackers with privileged access to inject malicious script content. When a victim views affected article listings, the injected payload executes in the browser context of the Joomla! site. The issue is tracked under CWE-79 and documented in the Joomla Security Advisory.

Critical Impact

Authenticated attackers can inject persistent JavaScript through readmore links in com_content, leading to session theft, administrative account takeover, and content manipulation when other users interact with affected pages.

Affected Products

• Joomla! CMS core component com_content
• Joomla! installations referenced by cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*
• Sites relying on Joomla! readmore link rendering

Discovery Timeline

• 2026-05-26 - CVE-2026-30895 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-30895

Vulnerability Analysis

The vulnerability resides in how Joomla!'s com_content component renders readmore links for articles. Output values placed into the readmore link markup are not properly escaped before being written to HTML. An attacker with sufficient privileges to author or edit content can inject HTML or JavaScript that the renderer emits verbatim. The payload executes in the context of any user who loads the affected listing or category view. Because the data is stored in the article record, exploitation persists across sessions until the malicious content is removed.

The scope is limited by the requirement for elevated privileges to inject the payload, but the impact extends to any visitor of the rendered page, including administrators whose sessions can be hijacked.

Root Cause

The root cause is missing context-aware escaping of dynamic values rendered into the readmore link element. The component emits attribute or text content without applying HTML entity encoding, violating the output encoding control defined by CWE-79. Joomla!'s built-in escaping helpers were not applied at the affected sink within the readmore rendering logic.

Attack Vector

The attack vector is network-based and requires high privileges and user interaction. An authenticated content author crafts an article whose metadata or link-related field contains an XSS payload. When a downstream user navigates to a page displaying the readmore link, the browser parses and executes the payload. Attackers can use this to hijack administrator sessions, perform actions on behalf of victims, or deface content. See the Joomla Security Advisory for vendor-confirmed details.

Detection Methods for CVE-2026-30895

Indicators of Compromise

• Article fields containing <script>, onerror=, onload=, or javascript: payloads in readmore-related attributes
• Outbound browser requests from administrator sessions to attacker-controlled domains following article views
• Unexpected creation of Super User accounts or modifications to user privileges shortly after content editing activity

Detection Strategies

• Audit the #__content table for HTML tags or JavaScript event handlers in title, alias, and metadata columns
• Review web server access logs for requests to article views correlated with anomalous administrative actions
• Monitor Joomla! action logs for content edits performed by lower-privileged authors followed by admin-level changes

Monitoring Recommendations

• Enable Joomla!'s built-in action logging and forward events to a centralized logging platform for correlation
• Deploy a Content Security Policy (CSP) with reporting to capture script execution attempts from injected payloads
• Alert on HTTP responses containing reflected user-controlled content within anchor or attribute contexts on com_content pages

How to Mitigate CVE-2026-30895

Immediate Actions Required

• Apply the Joomla! security update referenced in the Joomla Security Advisory
• Review all existing articles for malicious markup in fields rendered into readmore links
• Rotate administrator credentials and invalidate active sessions if exploitation is suspected

Patch Information

Joomla! has published a security advisory addressing the missing output escaping in com_content readmore links. Administrators should upgrade to the fixed Joomla! release identified in the Joomla Security Advisory. The patch introduces proper HTML escaping at the affected output sink.

Workarounds

• Restrict article authoring and editing privileges to trusted users until the patch is applied
• Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of injected payloads
• Use a web application firewall rule to block requests containing script tags or event handler attributes targeting com_content endpoints

# Example CSP header to limit inline script execution on Joomla! responses
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"