CVE-2026-66917
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
Risk Assessment
Risk of session theft, user account takeover, or malware distribution to site visitors.
Recommendation
Update JoomGallery to version 4.4.0 or later. Audit existing images for malicious payloads.
Other vulnerabilities in JoomGallery
See all- CVE-2026-84048Medium
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.
- CVE-2026-66916Medium
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
Original NVD description (English source)
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS