JMedia vulnerabilities
3 known CVE vulnerabilities in JMedia, translated and rated.
- CVE-2026-60034Critical
The Joomla extension JMedia versions below 1.6.0 is vulnerable to stored cross-site scripting (XSS). Unsanitized SVG uploads served without the nosniff header allow an attacker to inject malicious scripts that execute in other users' browsers.
- CVE-2026-60032Critical
The Joomla extension JMedia versions below 1.6.0 is vulnerable to authenticated arbitrary file upload. An authenticated attacker can upload executable files (including with polyglot filenames), and chmod does not strip execute bits, leading to remote code execution (RCE).
- CVE-2026-60033Medium
The JMedia extension for Joomla! versions below 1.6.0 is vulnerable to server-side request forgery (SSRF). The remote URL download functionality can be abused to target internal/reserved addresses.