VulnSocial

CVE-2026-73373Disclosure(joomla / joomla\!)

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

joomla CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • joomla\!

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
joomla
Products
joomla\!

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-12: 2Technical Details · 2026-09-12: 209-12
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • takenaka hiroya@Joe_Biden_ja
    Disclosure

    Joomla CVE-2026-73373 は CVSS 9.8 でも、刺さるかはサーバが SSI を実行するか次第。判定スクリプトで実測したら Options Includes が書いてあるのに mod_include 未読込という例が出ました https://blog.hashito.biz/2026/09/12/joomla-cve-2026-73373-shtml-upload-ssi-condition/

    Post summary

    Japanese blog note announces Joomla CVE-2026-73373 with CVSS 9.8, explains that exploitation hinges on server SSI support, and cites a testing example where Options Includes was present but mod_include was not loaded.

    0001058
    556 followersView on X
  • takenaka hiroya@Joe_Biden_ja
    Disclosure

    Joomla の危険な拡張子リストに SHTML が入っていませんでした。該当は 5.4.8 未満と 6.1.3 未満。SSI を実行する設定のサーバではアップロードからコード実行に届きます https://cve.autoarticles.net/cve/CVE-2026-73373

    Post summary

    The text reveals that Joomla versions below 5.4.8 and 6.1.3 have an upload‑based code‑execution flaw when SSI is enabled, but it does not supply a PoC, exploit code, or mitigation advice.

    0000065
    556 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appjoomlajoomla\!---

Explore more

Back to dashboardjoomla CVEsjoomla\! vulnerabilities