CVE-2026-35222: Joomla! SQL Injection Vulnerability

CVE-2026-35222 Overview

CVE-2026-35222 is an authenticated blind SQL injection vulnerability in the com_tags component of Joomla!. The flaw stems from improperly validated order clauses, allowing an attacker with high privileges to inject SQL fragments through ordering parameters. Successful exploitation enables extraction of database contents via blind SQL injection techniques. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact

Authenticated attackers can execute blind SQL injection against the Joomla! backend through the com_tags component, exposing confidential database records.

Affected Products

• Joomla! CMS core (com_tags component)
• Joomla! installations exposing authenticated administrative or content endpoints
• See the Joomla Security Advisory for the complete affected version range

Discovery Timeline

• 2026-05-26 - CVE-2026-35222 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-35222

Vulnerability Analysis

The vulnerability resides in the com_tags component of Joomla! CMS. The component accepts order clause parameters from authenticated users and passes them into SQL queries without sufficient validation. Because column ordering values are concatenated into query strings, attackers can append SQL fragments that the database engine evaluates.

This is a blind SQL injection. The application does not return the raw query result in HTTP responses. Instead, attackers infer data by observing response differences such as result ordering or boolean conditions encoded into the injected payload. Exploitation requires valid authenticated credentials with sufficient privileges to access com_tags, which limits the attack surface to insider threats, compromised accounts, or chained vulnerabilities.

Root Cause

The root cause is missing or insufficient allow-list validation on order-by parameters within com_tags. Order clauses cannot be parameterized using standard prepared-statement placeholders. Developers must therefore validate values against a strict allow-list of column names and directions. The affected code path failed to enforce this constraint, allowing attacker-controlled strings to reach the SQL execution layer.

Attack Vector

The attack vector is network-based and requires authentication with high privileges. An attacker submits crafted ordering parameters to a com_tags endpoint and observes response behavior to extract data character by character. No user interaction is needed beyond the attacker's own session. Refer to the Joomla Security Advisory for exploitation specifics.

Detection Methods for CVE-2026-35222

Indicators of Compromise

• Repeated authenticated HTTP requests to com_tags endpoints containing unusual filter_order, filter_order_Dir, or list[fullordering] parameter values
• SQL syntax tokens such as SLEEP(, BENCHMARK(, CASE WHEN, IF(, or UNION SELECT appearing in ordering parameters within web server access logs
• Anomalous query execution times in MySQL or MariaDB slow query logs originating from Joomla! database users

Detection Strategies

• Inspect web server and Joomla! access logs for non-allowlisted column names or punctuation characters submitted in ordering parameters
• Deploy web application firewall rules that match SQL keywords inside com_tags query string parameters
• Correlate authenticated administrative sessions with bursts of similar requests differing only in payload position, a hallmark of blind SQLi extraction

Monitoring Recommendations

• Enable Joomla! database query logging and alert on queries containing inline boolean or time-based conditions issued by the CMS database user
• Forward Joomla! and database logs to a centralized SIEM for cross-source correlation and retention
• Track failed and successful logins to administrative accounts and pair them with elevated request volume to com_tags

How to Mitigate CVE-2026-35222

Immediate Actions Required

• Apply the Joomla! security update referenced in the Joomla Security Advisory as soon as possible
• Audit privileged Joomla! accounts and rotate credentials for users able to access com_tags administrative functionality
• Review web server and database logs for prior exploitation attempts using the indicators above

Patch Information

Joomla! has published guidance in advisory 1039-20260507 covering the authenticated blind SQL injection in com_tags. Administrators should upgrade Joomla! core to the fixed release identified in the advisory. Verify the upgrade by confirming the installed version against the patched build in the Joomla! administrator panel.

Workarounds

• Restrict access to Joomla! administrator endpoints by IP allow-list at the reverse proxy or web server layer
• Enforce multi-factor authentication for all Joomla! accounts with elevated privileges to reduce the value of stolen credentials
• Deploy a web application firewall rule that rejects ordering parameters containing characters outside [A-Za-z0-9_.,\s]

# Example nginx rule rejecting suspicious ordering parameters to com_tags
location /index.php {
    if ($args ~* "option=com_tags.*(filter_order|fullordering)=[^&]*[^A-Za-z0-9_,.\s]") {
        return 403;
    }
}