CVE-2026-73373
HighCVSS 8.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Joomla! Core versions 1.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability of unrestricted uploads of SHTML files. The default list of dangerous files did not include SHTML files, which on servers that execute these files could lead to code execution.
Risk Assessment
An attacker can upload a malicious SHTML file, which when executed on the server can lead to arbitrary code execution, server takeover, or data integrity compromise.
Recommendation
Update Joomla! to a version that includes the fix (5.4.8 or later, 6.1.3 or later). Additionally, configure the server to not execute SHTML files.
Original NVD description (English source)
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.