CVE-2026-73373: Joomla! Core RCE Vulnerability

CVE-2026-73373 Overview

CVE-2026-73373 is an unrestricted file upload vulnerability in Joomla! Core. The default list of dangerous file types omitted Server-Side Include HTML (SHTML) files. Attackers with high privileges can upload .shtml files through Joomla's media handling. On web servers configured to execute SHTML, the uploaded content runs server-side and leads to code execution. The flaw is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type. Affected releases span Joomla 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2.

Critical Impact
Authenticated attackers can upload SHTML files that execute on the underlying web server, resulting in arbitrary code execution and full site compromise.

Affected Products

Joomla! Core 1.0.0 through 5.4.7
Joomla! Core 6.0.0 through 6.1.2
Joomla sites hosted on web servers configured to execute SHTML (for example, Apache with mod_include)

Discovery Timeline

2026-08-18 - CVE-2026-73373 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-73373

Vulnerability Analysis

Joomla! Core maintains a deny list of dangerous file extensions that the media manager and file upload routines refuse to accept. The list is used to block executable server-side content such as .php, .phtml, and similar handlers. The .shtml extension was absent from this list across all releases up to 5.4.7 and 6.1.2. Authenticated users with upload permissions can therefore submit SHTML files without triggering the dangerous-extension check. When Apache is configured with Options +Includes and an AddHandler server-parsed .shtml directive, the web server parses SHTML directives inside the uploaded file. The  directive then invokes arbitrary operating system commands with the privileges of the web server process.

Root Cause

The root cause is an incomplete deny list in Joomla's upload validation. The framework relied on enumerating dangerous extensions rather than allow-listing safe ones. SHTML was never added even though many hosting environments execute it. This is a classic instance of [CWE-434].

Attack Vector

Exploitation requires an authenticated account with file upload rights, such as an author, editor, or administrator. The attacker uploads a crafted .shtml file containing SSI directives through the Joomla media component or an extension that leverages core upload libraries. Requesting the uploaded URL from the public web root causes the server to execute the embedded commands. See the Joomla Security Advisory for vendor details.

Detection Methods for CVE-2026-73373

Indicators of Compromise

New or unexpected .shtml files present under Joomla media directories such as images/, tmp/, or component upload paths
Web server access logs showing GET requests to .shtml resources under Joomla-managed directories
Child processes such as sh, bash, curl, or wget spawned by the web server user (www-data, apache, nginx)

Detection Strategies

Audit the Joomla webroot for files with the .shtml extension and correlate creation timestamps against administrative upload activity
Inspect Apache and Nginx configurations for handlers that parse SHTML (AddHandler server-parsed .shtml, AddType text/x-server-parsed-html .shtml)
Review Joomla user activity logs for uploads performed by non-administrative accounts

Monitoring Recommendations

Alert on process creation events where the web server user launches shell interpreters or network utilities
Monitor file integrity on Joomla upload directories and flag creation of executable server-side extensions
Log and review all authenticated media manager actions for anomalous file types

How to Mitigate CVE-2026-73373

Immediate Actions Required

Upgrade Joomla! Core to a fixed release beyond 5.4.7 or 6.1.2 as published in the Joomla Security Advisory
Review all upload directories for existing .shtml files and quarantine any that are not attributable to a trusted administrator
Rotate credentials for accounts with upload permissions if evidence of misuse is found

Patch Information

Joomla addressed the issue by adding .shtml to the core list of dangerous file extensions. Site operators should apply the vendor update through the Joomla Update component or by deploying the patched package from joomla.org. Confirm the installed version reports higher than 5.4.7 or 6.1.2 after the update.

Workarounds

Disable Server-Side Includes on the hosting web server by removing Includes from Options and unregistering the .shtml handler
Add .shtml, .shtm, and .stm to the Joomla dangerous extensions configuration in Global Configuration → Media
Restrict upload privileges to a minimal set of trusted administrative users until patching is complete

bash

# Apache: disable SSI execution for the Joomla document root
<Directory "/var/www/joomla">
    Options -Includes -ExecCGI
    RemoveHandler .shtml .shtm .stm
    RemoveType .shtml .shtm .stm
</Directory>