CVE-2026-48901 Overview
CVE-2026-48901 affects the Joomla CMS core InputFilter::getInstance() method. The method omitted a security sensitive parameter when constructing the instance cache key. This caching defect [CWE-524] causes Joomla to return a cached InputFilter instance that does not reflect the security parameters requested by the caller. As a result, input filtering may operate with weaker settings than the developer intended, leading to information exposure through caching.
Critical Impact
A network attacker can reach Joomla code paths where input filtering relies on a cached InputFilter instance configured with weaker parameters than expected, exposing sensitive data without authentication or user interaction.
Affected Products
- Joomla! CMS core (see vendor advisory for affected branches)
- Extensions and code paths invoking InputFilter::getInstance() with security relevant arguments
- Installations relying on the default Joomla input filtering stack
Discovery Timeline
- 2026-05-26 - CVE-2026-48901 published to the National Vulnerability Database
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-48901
Vulnerability Analysis
The InputFilter::getInstance() method implements a singleton-style cache that returns existing filter instances keyed by their constructor arguments. The cache key construction omitted at least one security sensitive parameter. When two callers request InputFilter instances with different security parameters but identical values for the cached parameters, the second caller receives the first caller's instance.
This mismatch causes input filtering to apply the wrong security policy. Code paths expecting strict filtering may instead receive a permissive instance, weakening sanitization of user supplied input. The defect is classified as Information Exposure Through Caching [CWE-524].
The vulnerability is reachable over the network without authentication or user interaction. Confidentiality is the primary impact dimension, while integrity and availability are not directly affected per the published CVSS vector.
Root Cause
The root cause is incomplete cache key generation inside InputFilter::getInstance(). The method hashed or concatenated a subset of constructor arguments to form the lookup key. A security sensitive parameter that influences filter behavior was excluded. Cache lookups therefore collide across instances with materially different security postures.
Attack Vector
An unauthenticated attacker sends crafted HTTP requests to a Joomla endpoint that exercises InputFilter with strict security parameters after another code path has primed the cache with a weaker configuration. The cached weaker instance processes attacker controlled input. The vulnerability manifests in the cache key construction logic. See the Joomla Security Advisory 2026-05-17 for technical details and affected versions.
Detection Methods for CVE-2026-48901
Indicators of Compromise
- Unexpected HTML, script, or attribute content surviving Joomla input filtering in stored fields
- Repeated requests to endpoints that internally call InputFilter::getInstance() with varying security flags
- Web server logs showing requests crafted to prime caches before targeting sensitive endpoints
Detection Strategies
- Inventory Joomla installations and verify the running version against the vendor advisory
- Review custom extensions for direct calls to InputFilter::getInstance() with non-default security parameters
- Audit application logs for input that bypassed expected sanitization rules
Monitoring Recommendations
- Forward Joomla and web server logs to a centralized analytics platform for anomaly review
- Alert on outbound responses containing unsanitized markup from fields expected to be filtered
- Track patch state of Joomla core across all hosted instances
How to Mitigate CVE-2026-48901
Immediate Actions Required
- Apply the Joomla core update referenced in the vendor advisory
- Identify all Joomla instances, including staging and archived sites, and prioritize internet facing deployments
- Review third party extensions for direct use of InputFilter::getInstance() and validate they receive correctly configured instances after patching
Patch Information
Refer to the Joomla Security Advisory 2026-05-17 for the fixed version list and upgrade instructions. The fix corrects cache key construction so that all security relevant parameters participate in the lookup key.
Workarounds
- Where immediate patching is not possible, instantiate InputFilter objects directly with new JFilterInput(...) instead of relying on the shared cached instance
- Restrict access to administrative and form submission endpoints with a web application firewall until the patch is applied
- Disable or remove extensions that pass non-default security parameters to InputFilter::getInstance()
# Verify Joomla version after upgrade
php -r "define('_JEXEC',1); define('JPATH_BASE', __DIR__); require 'includes/defines.php'; require 'includes/framework.php'; echo (new \Joomla\CMS\Version())->getShortVersion();"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
