CVE-2026-71572: Joomla! Core Header Injection Vulnerability

CVE-2026-71572 Overview

CVE-2026-71572 is a response header injection vulnerability in the Joomla! Core download views. The flaw affects Joomla versions 3.0.0 through 5.4.7 and 6.0.0 through 6.1.2. The root cause is a lack of output processing on user-controlled input reflected into HTTP response headers. Attackers can leverage the injection to conduct reflected file download attacks and content-type confusion against authenticated users. The issue is tracked as CWE-93: Improper Neutralization of CRLF Sequences. Exploitation requires high privileges and user interaction, which limits mass exploitation but does not remove the risk for targeted attacks.

Critical Impact
Attackers can inject arbitrary HTTP response headers into Joomla download views, enabling reflected file download attacks and content-type confusion that trick users into executing attacker-controlled payloads under the trust context of the Joomla site.

Affected Products

Joomla! Core versions 3.0.0 through 5.4.7
Joomla! Core versions 6.0.0 through 6.1.2
Any Joomla deployment exposing the affected download views

Discovery Timeline

2026-08-18 - CVE-2026-71572 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71572

Vulnerability Analysis

The vulnerability resides in multiple download views within Joomla! Core. These views accept parameters that influence HTTP response headers sent back to the client. The application fails to sanitize or encode carriage return and line feed (CRLF) sequences before writing values into headers. An attacker who supplies crafted input can terminate the current header and inject additional headers or manipulate the Content-Type and Content-Disposition fields. This behavior aligns with [CWE-93] header injection patterns.

The exploitation path leads to two primary outcomes. First, reflected file download (RFD) attacks can convince a browser to save attacker-controlled content as an executable file that appears to originate from the trusted Joomla site. Second, content-type confusion allows the response body to be interpreted differently than intended, which can trigger unexpected client-side rendering or download behavior.

Root Cause

The root cause is missing output processing in the download view controllers. User-supplied values flow into HTTP header emission code without CRLF neutralization or strict allow-list validation.

Attack Vector

Exploitation is network-based. The attacker crafts a URL targeting an affected download view and delivers it to a privileged Joomla user through phishing or another social channel. When the victim loads the URL, the injected headers execute in their browser context. The high-privilege requirement means the attacker must target authenticated users, typically administrators or content editors. See the Joomla Security Advisory for the vendor description.

No public proof-of-concept is available. The vulnerability is described in prose by the vendor without an accompanying exploit disclosure.

Detection Methods for CVE-2026-71572

Indicators of Compromise

HTTP request logs containing URL-encoded CRLF sequences such as %0d%0a or %0A in query parameters directed at Joomla download endpoints
Response headers with unexpected Content-Type, Content-Disposition, or duplicated header names originating from download views
Outbound requests from administrator sessions that download files with mismatched extensions and MIME types

Detection Strategies

Inspect web server access logs for encoded newline characters within parameters passed to Joomla download controllers
Deploy web application firewall rules that block CRLF sequences in query strings and POST bodies for known Joomla download paths
Correlate administrator authentication events with anomalous download responses served from the same session

Monitoring Recommendations

Enable verbose logging on Joomla-facing reverse proxies to capture full request URIs and response headers
Alert on any HTTP response emitted by Joomla that contains more than one Content-Type header
Track privileged account activity for unusual download URLs shared through email or messaging platforms

How to Mitigate CVE-2026-71572

Immediate Actions Required

Upgrade Joomla! Core to a fixed release above 5.4.7 in the 5.x branch or above 6.1.2 in the 6.x branch as specified in the vendor advisory
Audit privileged Joomla accounts and enforce multi-factor authentication to reduce the impact of user-interaction-based attacks
Review recent download view request logs for signs of CRLF injection attempts

Patch Information

Joomla has published fixed versions and remediation guidance in the Joomla Security Advisory 20260801. Administrators should apply the vendor patch through the Joomla Update component or by deploying updated release packages from the Joomla Official Website.

Workarounds

Restrict access to Joomla administrator and download endpoints using IP allow-lists at the reverse proxy or firewall layer
Configure a web application firewall to reject requests containing %0d, %0a, or literal CRLF bytes in parameters reaching download views
Temporarily disable non-essential extensions that rely on the affected download views until the patch is applied

bash

# Example ModSecurity rule to block CRLF injection in query strings
SecRule ARGS "@rx (?i)(%0d|%0a|\r|\n)" \
    "id:1007101,\
    phase:2,\
    deny,\
    status:400,\
    msg:'CRLF injection attempt targeting Joomla download view',\
    tag:'CVE-2026-71572'"