CVE-2026-78071 Overview
CVE-2026-78071 is a stored cross-site scripting (XSS) vulnerability in Digital Peak's DP Calendar extension for Joomla. The flaw affects versions 7.0.0 through 10.11.2. The extension renders the location title within an HTML data attribute without proper escaping, allowing authenticated users with create permission in DPCalendar to inject persistent JavaScript payloads. When other users view the affected calendar view, the payload executes in their browser context. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated attackers with event creation privileges can inject persistent JavaScript that executes in the browsers of administrators and other calendar viewers, enabling session hijacking and account takeover.
Affected Products
- Digital Peak DP Calendar for Joomla, version 7.0.0
- Digital Peak DP Calendar for Joomla, versions 7.0.0 through 10.11.2
- Joomla sites with DPCalendar create permissions granted to non-administrator roles
Discovery Timeline
- 2026-08-28 - CVE-2026-78071 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-78071
Vulnerability Analysis
The DP Calendar extension stores user-supplied event metadata, including location records. When the calendar view is rendered, the location title is emitted inside an HTML data-* attribute. The output routine writes the value directly into the attribute without applying HTML attribute escaping. An attacker who supplies a payload containing quote characters can break out of the attribute context and inject arbitrary HTML or JavaScript.
Exploitation requires an authenticated account with the DPCalendar create permission. This is a privileged prerequisite but not an administrative one. Many Joomla deployments delegate event creation to editors, contributors, or registered community members. Once a malicious location is stored, the payload executes for every user who loads a view that references it.
Root Cause
The root cause is missing context-aware output encoding. The template layer concatenates the location title into a data attribute rather than passing it through Joomla's htmlspecialchars wrapper with ENT_QUOTES. This omission causes double or single quote characters in the stored title to terminate the attribute early and let the parser interpret injected markup as executable content.
Attack Vector
The attack proceeds in three stages. First, the attacker authenticates and uses the DPCalendar create endpoint to submit a location whose title contains a JavaScript payload delimited by an attribute-breaking quote. Second, the vulnerable component stores the title verbatim in the database. Third, when any user renders a page that includes the location in a data attribute, the browser executes the injected script under the origin of the Joomla site. The script can steal session cookies, perform actions on behalf of the victim, or pivot to administrator-only endpoints if a Super User views the page. See the Digital Peak DP Calendar product page for component details.
Detection Methods for CVE-2026-78071
Indicators of Compromise
- DPCalendar location records whose title field contains <script>, onerror=, onload=, or javascript: substrings
- Outbound requests from browsers loading calendar pages to attacker-controlled domains hosting exfiltration endpoints
- Unexpected administrative actions performed from accounts immediately after a Super User viewed a calendar page
- New privileged Joomla user accounts created shortly after a calendar view session
Detection Strategies
- Query the DPCalendar locations table for entries whose title contains HTML tag characters, quote characters, or event handler attributes
- Review Joomla access logs for POST requests to DPCalendar create endpoints originating from non-administrator accounts
- Inspect rendered HTML for stray attribute boundaries around data- attributes generated by DPCalendar templates
- Correlate Content Security Policy (CSP) violation reports with calendar page URLs
Monitoring Recommendations
- Enable Joomla action logging for the com_dpcalendar component and forward events to a centralized log platform
- Alert on modifications to location records performed by low-privilege user groups
- Monitor administrator session activity that follows visits to public calendar pages
How to Mitigate CVE-2026-78071
Immediate Actions Required
- Upgrade DP Calendar to a fixed release above 10.11.2 as published by Digital Peak
- Audit and revoke the DPCalendar create permission from user groups that do not require it
- Review existing location records and sanitize or remove any entries containing HTML or script content
- Rotate administrator session tokens and reset credentials for accounts that visited calendar pages during the exposure window
Patch Information
Digital Peak addresses the issue in DP Calendar releases after 10.11.2. Refer to the Digital Peak DP Calendar product page for the current release and changelog. Apply the update through the Joomla Extensions Manager and verify the installed version in the extension list after upgrade.
Workarounds
- Restrict the DPCalendar create permission to trusted administrator groups until the patch is applied
- Deploy a strict Content Security Policy that blocks inline script execution on pages rendering calendar data
- Place a web application firewall rule in front of the create endpoint to reject payloads containing angle brackets or quote characters in the location title field
- Temporarily disable public calendar views that render location data attributes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
