CVE-2026-71572
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Joomla! Core has a response header injection vulnerability in download views. Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.
Risk Assessment
An attacker can manipulate response headers, potentially leading to unexpected file downloads or content-type confusion attacks, possibly enabling malicious code execution.
Recommendation
Update Joomla! to a version where output processing in download views is fixed.
Original NVD description (English source)
Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion.