CVE-2026-74804: Joomla Zoo Extension SQLi Vulnerability

CVE-2026-74804 Overview

CVE-2026-74804 is an unauthenticated SQL injection vulnerability in the YOOtheme Zoo extension for Joomla, affecting versions prior to 4.1.64. The flaw resides in the ItemController::element() method, where the filter_type request parameter is interpolated directly into a SQL query as a.type = "...", and the type_filter array is interpolated as a.type IN ("..."). Neither value is quoted or escaped before use. Attackers can reach the endpoint without authentication and manipulate the query to read arbitrary database contents. The vulnerability is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can inject arbitrary SQL through the filter_type or type_filter request parameters, exposing all data stored in the Joomla database.

Affected Products

YOOtheme Zoo extension for Joomla, versions earlier than 4.1.64
Joomla sites that expose the Zoo ItemController::element() endpoint
Any deployment relying on the vulnerable filter_type or type_filter request parameters

Discovery Timeline

2026-08-19 - CVE-2026-74804 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74804

Vulnerability Analysis

The vulnerability exists in the ItemController::element() method of the YOOtheme Zoo extension. The controller accepts two user-controlled inputs from the HTTP request: filter_type (a scalar string) and type_filter (an array). Both inputs are placed directly into a SQL statement using string interpolation.

For the scalar case, the resulting fragment is a.type = "$filter_type". For the array case, values are joined and inserted as a.type IN ("$val1","$val2",...). No parameter binding, escaping, or type validation occurs before the query executes. An attacker who supplies a double-quote character can terminate the literal and append arbitrary SQL clauses such as UNION SELECT payloads.

Because the endpoint does not require authentication, exploitation only requires network access to the Joomla site running the affected Zoo version. Successful injection allows the attacker to enumerate the schema, exfiltrate content and user records, and read password hashes and session tokens stored by Joomla.

Root Cause

The root cause is the concatenation of untrusted request values into a raw SQL string. The developer relied on implicit type expectations rather than parameterized queries or an allowlist of permitted type values. The double-quoted string context provides no protection because attacker input can contain a literal " byte.

Attack Vector

Exploitation occurs over the network against any public Joomla site running Zoo below version 4.1.64. The attacker crafts an HTTP request to the Zoo element endpoint and places SQL payloads inside the filter_type parameter or any element of the type_filter[] array. See the YOOtheme Security Overview for vendor advisory details.

The vulnerability is described in prose only. No verified proof-of-concept exploit code is published in the NVD entry at this time.

Detection Methods for CVE-2026-74804

Indicators of Compromise

HTTP requests to Joomla Zoo endpoints containing double-quote characters, UNION, SELECT, SLEEP, or INFORMATION_SCHEMA tokens inside the filter_type or type_filter[] parameters.
Unusual database error messages or long-running queries originating from the Zoo component in Joomla logs.
Outbound DNS or HTTP callbacks from the database server that correlate with time-based or out-of-band SQL injection payloads.

Detection Strategies

Inspect web server access logs for the Zoo controller path with suspicious filter_type or type_filter[] values, especially those containing quotes, comments (--, #), or SQL keywords.
Enable database query logging and alert on queries against the Zoo items table that include UNION, subqueries, or INFORMATION_SCHEMA references.
Deploy a WAF rule that blocks non-alphanumeric characters in the filter_type and type_filter[] request parameters bound for Joomla Zoo routes.

Monitoring Recommendations

Correlate spikes in 500-series responses from the Zoo endpoint with high request volume from a single source address.
Monitor for new administrative accounts, unexpected content changes, or password resets in Joomla immediately following anomalous requests to the Zoo controller.
Track database user activity for reads against users, sessions, or credential tables initiated by the Joomla application account.

How to Mitigate CVE-2026-74804

Immediate Actions Required

Upgrade the YOOtheme Zoo extension to version 4.1.64 or later on every Joomla instance.
Audit web server and database logs for prior exploitation attempts against the Zoo element endpoint since the extension was installed.
Rotate Joomla administrator passwords, API tokens, and any secrets stored in the database if compromise cannot be ruled out.

Patch Information

YOOtheme has addressed the issue in Zoo 4.1.64. Administrators should download the fixed release from the vendor and apply it through the Joomla extension manager. Refer to the YOOtheme Security Overview for the official release notes.

Workarounds

Restrict access to the Joomla Zoo element endpoint at the reverse proxy or WAF until the patch is applied.
Enforce input validation at the web server layer that rejects requests where filter_type or type_filter[] contain characters outside [A-Za-z0-9_-].
Run the Joomla database account with least-privilege permissions so that a successful injection cannot modify schema or execute administrative statements.

bash

# Example WAF rule (ModSecurity) to block suspicious Zoo filter parameters
SecRule ARGS:filter_type|ARGS:'type_filter[]' "@rx [\"';()]|(?i:union|select|sleep|information_schema)" \
    "id:1074804,phase:2,deny,status:403,msg:'Potential CVE-2026-74804 SQLi in YOOtheme Zoo'"