PT-2026-1462 · Joomla+2 · Joomla! Cms+1

Sho Sugiyama · Published 2026-01-06 · Updated 2026-01-31 · CVE-2025-63082

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions versions prior to 2025 (affected versions not specified)

Description A flaw exists due to insufficient input validation, resulting in a cross-site scripting (XSS) vector within the HTML filter code. This issue specifically relates to data URLs found within img tags. The vulnerability allows for the injection of malicious scripts through crafted image tags.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JOOMLA-2025-63082

CVE-2025-63082

Affected Products

Joomla! Cms

Joomla!

References · 6

• https://developer.joomla.org/security-centre/1016-20260101-core-inadequate-content-filtering-for-data-urls.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-joomla-2025-63082 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-63082 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63082 · Security Note
• https://twitter.com/CVEnew/status/2008575257180074487 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008671163031978344 · Twitter Post