CVE-2026-66917 Overview
CVE-2026-66917 is a stored Cross-Site Scripting (XSS) vulnerability in the JoomGallery extension for Joomla, distributed by joomgalleryfriends.net. The flaw affects JoomGallery versions prior to 4.4.0. An authenticated attacker with privileged access can inject a JavaScript payload into any image record. The payload persists in the gallery and executes in the browser of every visitor who views the affected content. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Stored JavaScript payloads execute in every visitor's browser, enabling session theft, credential harvesting, and site defacement across all gallery viewers.
Affected Products
- JoomGallery extension for Joomla, versions prior to 4.4.0
- Joomla sites using JoomGallery from joomgalleryfriends.net
- Public-facing image galleries built on vulnerable JoomGallery releases
Discovery Timeline
- 2026-08-22 - CVE-2026-66917 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-66917
Vulnerability Analysis
The vulnerability is a stored XSS flaw in JoomGallery, a media gallery extension for the Joomla content management system. An authenticated user with privileged access to image management can embed JavaScript into image metadata fields. The extension stores the payload without adequate output encoding. Every visitor who loads the gallery page executes the injected script within their browser session.
Stored XSS in a shared gallery module carries broader impact than reflected variants because the payload persists server-side. Attackers can pivot from initial injection to session hijacking, forced administrative actions, and drive-by malware delivery against site visitors.
Root Cause
The root cause is improper neutralization of user-supplied input during web page generation, classified as CWE-79. JoomGallery accepts image metadata from privileged users and renders it back to the page without sufficient HTML entity encoding or content sanitization. Because the attacker must be authenticated with elevated permissions, exploitation depends on account compromise, malicious insiders, or overly permissive role assignments.
Attack Vector
Exploitation follows a network-based path over standard HTTP or HTTPS. A privileged authenticated user submits an image upload or edit request containing a crafted script payload inside a metadata field. The gallery persists the payload in the JoomGallery data store. When any subsequent visitor renders the image or gallery view, the browser parses the payload as executable JavaScript. No further user interaction is required beyond viewing the page.
Refer to the JoomGalleryFriends Community Site for advisory details and remediation guidance.
Detection Methods for CVE-2026-66917
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: sequences persisted in JoomGallery image title, description, or alt-text fields.
- Outbound requests from visitor browsers to unfamiliar domains immediately after loading gallery pages.
- New or modified administrative Joomla accounts created shortly after a gallery visit by a site administrator.
Detection Strategies
- Query the JoomGallery database tables for HTML control characters and JavaScript event handlers in stored image metadata.
- Review Joomla audit logs for image create and edit actions performed by privileged accounts that do not typically manage media.
- Deploy a Content Security Policy (CSP) with reporting enabled to surface inline script execution attempts on gallery pages.
Monitoring Recommendations
- Alert on anomalous outbound traffic from web application users viewing /component/joomgallery/ or equivalent gallery URLs.
- Monitor privileged Joomla account activity for lateral movement into content management functions.
- Track file upload and metadata edit endpoints for payloads containing angle brackets, event handlers, or encoded script markers.
How to Mitigate CVE-2026-66917
Immediate Actions Required
- Upgrade JoomGallery to version 4.4.0 or later on every Joomla instance running the extension.
- Audit all existing image records for stored script payloads and remove or sanitize any suspicious metadata.
- Review and reduce the number of accounts holding privileged JoomGallery permissions.
Patch Information
The vendor addresses the flaw in JoomGallery version 4.4.0. Site operators should download the latest release from the JoomGalleryFriends Community Site and apply it through the standard Joomla extension update workflow. After patching, clear the Joomla cache and rescan stored gallery content to confirm no residual payloads remain.
Workarounds
- Temporarily restrict image upload and edit permissions to a minimal set of trusted administrators until the patch is applied.
- Enforce a strict Content Security Policy that blocks inline scripts on pages rendering gallery content.
- Place a web application firewall rule in front of Joomla administrative endpoints to filter script tags and event handler attributes in image metadata fields.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
