Home

Description

The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key.

PUBLISHED Reserved 2026-05-26 | Published 2026-05-26 | Updated 2026-06-05 | Assigner Joomla

Product status

Default status
unaffected

4.0.0-5.4.5
affected

6.0.0-6.1.0
affected

Credits

@ZeroXJacks, https://github.com/ZeroXJacks finder

References

developer.joomla.org/...ruction-for-inputfilter-objects.html vendor-advisory

cve.org (CVE-2026-48901)

nvd.nist.gov (CVE-2026-48901)

Download JSON