Summary
Media custom-field values can reach HTML attributes without context-appropriate escaping, allowing a user with field-edit permission to store JavaScript that executes when another visitor renders the affected content.
Affected Products
Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3 per the vendor advisory. Original report tested Joomla 6.1.2. Fixed in 5.4.9 / 6.1.4.
Affected Scope
- Product
- Joomla
- Component
- Generic media output layouts and media custom fields
- Affected function
- layouts/joomla/html/video.php; plugins/fields/media/tmpl/video.php; Joomla Utilities ArrayHelper::toString
- Affected versions
- Joomla 4.0.0–5.4.8 and 6.0.0–6.1.3
- CWE
- CWE-79, CWE-116
Technical Summary
Media custom-field values can reach HTML attributes without context-appropriate escaping, allowing a user with field-edit permission to store JavaScript that executes when another visitor renders the affected content.
Prerequisites and Permissions
Permission to edit the affected custom-field value (Administrator by default). A visitor must render the affected media output. Author/Manager reachability is not assumed.
Affected Locations
layouts/joomla/html/video.php; plugins/fields/media/tmpl/video.php; Joomla Utilities ArrayHelper::toString
Reproducible Proof
In an isolated Joomla 6.1.2 lab, create a video media custom field and submit a harmless attribute-breakout marker through an account with core.edit.value. Inspect the rendered video element as a separate test visitor and verify whether the value is correctly encoded. A benign browser indicator may be used without accessing credentials or performing administrative actions.
Vulnerable Code
$displayData[&class="tok-comment">#39;poster'] = (HTMLHelper::cleanImageURL($poster))->url;
class="tok-comment">// ...
echo LayoutHelper::render(&class="tok-comment">#39;joomla.html.video', $displayData);
class="tok-comment">// Source report: non-src attributes are emitted via ArrayHelper::toString without HTML attribute encoding.Severity
medium
CVSS
4.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Technical Analysis
The video layout escapes src but passes other attributes, including poster, through ArrayHelper::toString() without HTML attribute encoding. cleanImageURL() is not an attribute encoder. Media custom-field values do not follow the article body’s global text-filter path, so stripping HTML tags alone leaves attribute-breakout strings intact.
The source report corrected its reachability claim: core.edit.value is required, and default access is Administrator/Super User, not Author or Manager. The confirmed defect is stored XSS through media output. The vendor advisory addresses generic audio/video layout escaping; other sinks mentioned in the original report are not treated here as independently confirmed fixes.
Original Joomla finding 04. Vendor-confirmed and fixed; see the coordination notes and linked official advisory.
Impact
Confidentiality and integrity: script executes in the affected site origin with the viewing user’s privileges. Exposure of an active privileged session can amplify the effect, but server-side code execution is not independently established by this advisory.
Remediation
Upgrade to Joomla 6.1.4 / 5.4.9 or a later supported release. Apply HTML attribute encoding to all user-controlled layout attributes, and retain appropriate URL validation for URL-bearing fields.
Vendor advisory: https://developer.joomla.org/security-centre/1084-20260904-core-xss-in-the-generic-media-output-layouts.html
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan.