CVE-2026-76569: Phoca Download XSS Vulnerability

CVE-2026-76569 Overview

CVE-2026-76569 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the Phoca Download extension for Joomla, versions 5.0.0 through 6.1.4. The flaw exists in the handling of the search GET parameter, which reflects user-controlled input into the response without proper output encoding. An attacker can craft a malicious URL that executes arbitrary JavaScript in a victim's browser when clicked. The vulnerability is categorized under CWE-79 and requires user interaction to trigger. Successful exploitation can lead to session hijacking, credential theft, or redirection to attacker-controlled resources within the context of the affected Joomla site.

Critical Impact
Attackers can execute arbitrary JavaScript in a visitor's browser session by tricking users into loading crafted URLs against the vulnerable Phoca Download search endpoint.

Affected Products

Phoca Download extension for Joomla, versions 5.0.0 through 6.1.4
Joomla sites with the Phoca Download search feature exposed
See Phoca Cart Overview for vendor product information

Discovery Timeline

2026-08-20 - CVE-2026-76569 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76569

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) flaw in the Phoca Download Joomla extension. The search GET parameter accepts user input and reflects it directly into the rendered HTML response. Because the input is not properly sanitized or output-encoded, an attacker can inject arbitrary HTML and JavaScript payloads.

Reflected XSS requires social engineering. The attacker delivers a crafted URL to a target, typically through phishing emails, chat messages, or malicious links on other sites. When the victim visits the URL, the injected script executes under the origin of the vulnerable Joomla site.

Consequences include theft of session cookies, keystroke capture, forced actions performed as the authenticated user, and phishing overlays that harvest credentials. Administrator accounts are the highest-value targets because their sessions can be leveraged to install extensions or modify site content.

Root Cause

The root cause is missing output encoding of the search GET parameter before it is written back into the HTML response. The application trusts client-supplied input and does not apply context-appropriate escaping such as HTML entity encoding for element content or attribute encoding for HTML attributes.

Attack Vector

Exploitation requires network access to the vulnerable Joomla site and user interaction. An attacker constructs a URL that includes a JavaScript payload in the search parameter and delivers it to the victim. When the victim requests the URL, the vulnerable server reflects the payload into the response and the browser executes it in the site's origin.

No verified public proof-of-concept code is available. Refer to the Phoca vendor site for advisory updates.

Detection Methods for CVE-2026-76569

Indicators of Compromise

Web server access logs containing requests to Phoca Download URLs with search query parameters holding HTML tags such as <script>, onerror=, onload=, or encoded variants like %3Cscript%3E.
Referrer headers pointing to unfamiliar external domains that forwarded users to the site's Phoca Download search endpoint.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting a Phoca Download page.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the search parameter for HTML tags, event handlers, and JavaScript URI schemes on paths served by the Phoca Download extension.
Correlate web server logs with browser telemetry to identify sessions that loaded suspicious search values followed by anomalous script execution or cookie access.
Enable Content Security Policy (CSP) reporting to surface script execution attempts from inline or non-allowlisted sources.

Monitoring Recommendations

Alert on inbound URLs to Joomla sites containing URL-encoded angle brackets or javascript: schemes in query strings.
Track authenticated administrator sessions for concurrent access from unexpected IP addresses, which may indicate cookie theft.
Review CSP violation reports and browser error logs for repeated script-src violations tied to Phoca Download pages.

How to Mitigate CVE-2026-76569

Immediate Actions Required

Upgrade the Phoca Download extension to a fixed version once released by the vendor. Monitor the Phoca website for the patched build.
Restrict access to Joomla administrative areas by IP allowlisting or VPN until the extension is patched.
Notify site administrators to avoid clicking untrusted links referencing the site's Phoca Download search endpoint.

Patch Information

The vulnerability affects Phoca Download versions 5.0.0 through 6.1.4. Consult the vendor at phoca.cz for the current patched release and upgrade instructions.

Workarounds

Deploy a WAF rule that blocks or sanitizes HTML metacharacters in the search query parameter on Phoca Download URLs.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Temporarily disable the Phoca Download extension if the search feature is not required for site operations.

bash

# Example ModSecurity rule blocking script tags in the search parameter
SecRule ARGS:search "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1007656,phase:2,deny,status:403,\
    msg:'CVE-2026-76569 Phoca Download reflected XSS attempt'"