CVE-2026-73373: joomla joomla\!

CVSS 9.8 (critical) · published 2026-08-18

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

Affected products (NVD): joomla joomla\!

Fixed in (NVD): 5.4.8, 6.1.3

Weakness: CWE-434

Source: NVD CVE-2026-73373

References

• https://developer.joomla.org/security-centre/1077-20260810-core-unrestricted-uploads-of-shtml-files.html
• https://www.joomla.org/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.