CVE-2026-94130: YouTube Gallery Extension SQLi Vulnerability

CVE-2026-94130 Overview

CVE-2026-94130 is an unauthenticated SQL injection vulnerability in the YouTube Gallery extension for Joomla, developed by joomlaboat.com. The flaw affects versions prior to 5.7.3 and resides in the extension's video search and sorting functionality. Attackers can inject arbitrary SQL commands into read queries without authentication, enabling extraction of database contents. The vulnerability is categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can remotely inject SQL commands against Joomla sites running YouTube Gallery < 5.7.3, exposing stored database records including user data and credentials.

Affected Products

joomlaboat.com YouTube Gallery extension for Joomla versions prior to 5.7.3
Joomla CMS installations with the vulnerable extension installed
Any public-facing site exposing the extension's video search or sorting parameters

Discovery Timeline

2026-09-26 - CVE-2026-94130 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-94130

Vulnerability Analysis

The YouTube Gallery extension exposes video search and sorting functionality to unauthenticated users. User-controlled input flows into database read queries without proper parameterization or input sanitization. An attacker can supply crafted parameters that break out of the intended query context and append arbitrary SQL clauses.

Because the vulnerable code paths require no authentication and no user interaction, exploitation can be fully automated. Successful injection allows reading of any data in the Joomla database, including the #__users table containing hashed credentials, session tokens, and configuration data.

Root Cause

The root cause is improper neutralization of SQL metacharacters in user-supplied search terms and sort parameters [CWE-89]. The extension concatenates request parameters directly into SQL statements rather than using Joomla's prepared statement API such as JDatabaseQuery::bind() or the quote() and quoteName() helpers.

Attack Vector

The attack is delivered over the network against the Joomla front-end component endpoint registered by the YouTube Gallery extension. An attacker crafts HTTP GET or POST requests to the search or sort functionality, embedding SQL payloads such as UNION SELECT statements or boolean-based blind injection patterns in the vulnerable parameters. The server executes the injected SQL and returns responses that disclose database contents directly or through inferred side channels.

No code example is included because no verified public proof-of-concept has been published. Refer to the JoomlaBoat YouTube Gallery Plugin page for product details.

Detection Methods for CVE-2026-94130

Indicators of Compromise

HTTP requests to Joomla endpoints invoking the YouTube Gallery component with suspicious characters such as single quotes, UNION, SELECT, SLEEP(, or SQL comment sequences in search or sort parameters
Web server access logs showing repeated requests from a single source with incrementally changing payloads indicating automated SQL injection tooling
Unexpected database errors in Joomla logs referencing the YouTube Gallery extension's queries

Detection Strategies

Deploy Web Application Firewall (WAF) rules that match SQL injection signatures targeting Joomla component parameters such as option=com_youtubegallery
Inspect MySQL general or slow query logs for abnormal UNION-based or time-based queries originating from the Joomla database user
Compare installed Joomla extension inventory against the fixed version 5.7.3 using Joomla's Extension Manager or the CLI

Monitoring Recommendations

Enable verbose logging on the Joomla front-end and forward web server logs to a centralized analytics platform for pattern analysis
Alert on HTTP 500 responses from the YouTube Gallery component paths, which often indicate failed injection attempts
Monitor for unexpected outbound data volumes from the Joomla web server that could indicate large-scale database exfiltration

How to Mitigate CVE-2026-94130

Immediate Actions Required

Upgrade the YouTube Gallery extension to version 5.7.3 or later through the Joomla Extension Manager without delay
If an upgrade cannot be applied immediately, disable or uninstall the YouTube Gallery extension until patching is possible
Rotate Joomla administrator credentials and any secrets stored in the database on sites that were publicly reachable before patching

Patch Information

The vendor has released version 5.7.3 of the YouTube Gallery extension, which addresses the SQL injection in the video search and sorting functionality. Obtain the updated release from the JoomlaBoat YouTube Gallery Plugin page and apply it through the standard Joomla update workflow.

Workarounds

Restrict access to the vulnerable component paths at the reverse proxy or WAF layer until the patch is applied
Apply generic SQL injection filtering rules to all request parameters passed to com_youtubegallery
Reduce the privileges of the Joomla MySQL user to the minimum required, limiting the impact of a successful read-based injection

bash

# Configuration example: block requests containing common SQLi tokens to the vulnerable component
# Example ModSecurity rule (adapt IDs and paths to your environment)
SecRule REQUEST_URI "@contains option=com_youtubegallery" \
    "phase:2,chain,deny,status:403,id:1026094130,msg:'Possible CVE-2026-94130 SQLi attempt'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|/\*)" "t:none,t:urlDecodeUni"