CVE-2026-66917

HighCVSS 8.6

Published: 22/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.

Risk Assessment

Risk of session theft, user account takeover, or malware distribution to site visitors.

Recommendation

Update JoomGallery to version 4.4.0 or later. Audit existing images for malicious payloads.

Other vulnerabilities in JoomGallery

CVE-2026-66916Medium
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.

Original NVD description (English source)

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.