CVE-2026-75948: Joomla iCagenda XSS Vulnerability

CVE-2026-75948 is an authenticated stored XSS vulnerability in Joomla iCagenda extension versions 4.0.8 to 4.0.12. The flaw allows attackers to inject malicious scripts through event submission forms. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-75948 Overview

CVE-2026-75948 is an authenticated stored Cross-Site Scripting (XSS) vulnerability in the iCagenda Joomla extension, versions 4.0.8 through 4.0.12. The frontend Submit an Event form stores the image and file fields as raw strings without output-side HTML-attribute escaping. Authenticated users can inject persistent JavaScript payloads that execute in the browsers of visitors and administrators who view affected event pages. The flaw is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers with low-privilege frontend accounts can persist arbitrary JavaScript that executes in administrator sessions, enabling session hijacking, credential theft, and Joomla backend compromise.

Affected Products

iCagenda for Joomla version 4.0.8
iCagenda for Joomla versions 4.0.9 through 4.0.11
iCagenda for Joomla version 4.0.12

Discovery Timeline

2026-08-20 - CVE-2026-75948 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75948

Vulnerability Analysis

The iCagenda extension exposes a frontend Submit an Event form that accepts user-supplied metadata for events. The image and file parameters are stored verbatim in the database. When events are rendered, these values are placed inside HTML attributes without escaping quotes, angle brackets, or event handlers. An authenticated submitter can break out of the attribute context and inject arbitrary script. Because the payload persists in event records, every visitor to the affected event page triggers execution. The attack requires only a low-privilege authenticated account and minimal user interaction, since victims only need to browse the compromised event listing.

Root Cause

The root cause is missing output encoding on HTML attribute contexts. The extension does not apply Joomla's htmlspecialchars or JOutputFilter routines to the image and file fields before rendering. Input filtering on the submission endpoint is also absent for these fields, so attribute-breaking characters such as ", ', and > reach storage intact.

Attack Vector

An attacker registers or uses an existing frontend Joomla account with permission to submit events. They submit an event containing a crafted payload in the image or file field designed to escape the surrounding HTML attribute and introduce an event handler such as onerror or onload. Once an administrator or another user views the event listing or detail page, the injected script executes with the victim's session context. Attackers can steal Joomla admin cookies, perform Cross-Site Request Forgery (CSRF) actions, or plant a persistent backdoor via extension installation. See the iCagenda project site for extension details.

Detection Methods for CVE-2026-75948

Indicators of Compromise

Event records in the iCagenda database tables where the image or file columns contain characters such as <, >, ", or substrings like onerror=, onload=, javascript:, or <script.
Web server access logs showing POST requests to the iCagenda event submission endpoint with unusually long or encoded image/file parameters.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing event pages.

Detection Strategies

Query the iCagenda events table for stored payload signatures: pattern-match image and file fields against known XSS indicators.
Deploy a Web Application Firewall (WAF) rule that inspects event submission POST bodies for HTML attribute-breaking sequences.
Correlate frontend event submissions with subsequent administrator sessions to identify suspicious viewing patterns.

Monitoring Recommendations

Enable Joomla action logging for the iCagenda component and forward logs to a centralized log platform for retention and search.
Monitor for new administrator accounts, template modifications, or extension installations occurring after event submissions by low-privilege users.
Alert on Content Security Policy (CSP) violations reported by browsers that view iCagenda event pages.

How to Mitigate CVE-2026-75948

Immediate Actions Required

Restrict frontend event submission to trusted user groups until a patched release of iCagenda is installed.
Audit existing event records for stored payloads in the image and file fields and sanitize or delete affected rows.
Rotate Joomla administrator credentials and invalidate active sessions if suspicious event submissions are found.

Patch Information

No fixed version was published in the NVD entry at the time of disclosure. Administrators should monitor the iCagenda project site and the Joomla Extensions Directory for a release above 4.0.12 that addresses the stored XSS.

Workarounds

Disable the iCagenda frontend Submit an Event form via the extension configuration until a patch is available.
Deploy a Content Security Policy that blocks inline script execution and restricts script sources on pages that render iCagenda content.
Configure a WAF rule that rejects submissions where image or file fields contain <, >, or " characters.

bash

# Example ModSecurity rule to block attribute-breaking payloads in iCagenda submissions
SecRule REQUEST_URI "@contains option=com_icagenda" \
    "chain,phase:2,deny,status:403,id:1075948,\
    msg:'CVE-2026-75948 iCagenda stored XSS attempt'"
    SecRule ARGS:image|ARGS:file "@rx [<>\"']|on[a-z]+\s*=|javascript:" \
        "t:lowercase,t:urlDecodeUni"