Summary
InputFilter decodes HTML4 entities before checking dangerous URI schemes, while browsers recognize HTML5 entities. A scheme split with an HTML5-only whitespace entity can survive filtering and regain JavaScript URL semantics in a browser.
Affected Products
Original report tested Joomla 6.1.2. The technically matching vendor advisory lists 1.5.0–5.4.8 and 6.0.0–6.1.3, fixed in 5.4.9 / 6.1.4. The association with CVE-2026-92231 is inferred from the matching root cause, not an explicit per-finding CVE assignment in the email.
Affected Scope
- Product
- Joomla
- Component
- Shared HTML InputFilter and text-filter consumers
- Affected function
- libraries/vendor/joomla/filter/src/InputFilter.php — checkAttribute / cleanAttributes; ComponentHelper::filterText
- Affected versions
- Tested Joomla 6.1.2; related vendor advisory lists 1.5.0–5.4.8 and 6.0.0–6.1.3
- CWE
- CWE-79, CWE-116
Technical Summary
InputFilter decodes HTML4 entities before checking dangerous URI schemes, while browsers recognize HTML5 entities. A scheme split with an HTML5-only whitespace entity can survive filtering and regain JavaScript URL semantics in a browser.
Prerequisites and Permissions
An account able to submit HTML processed by the relevant text filter (Author in the original lab). A victim must interact with a rendered URL in an affected output context. The default SEF article rendering can block this demonstrated vector.
Affected Locations
libraries/vendor/joomla/filter/src/InputFilter.php — checkAttribute / cleanAttributes; ComponentHelper::filterText
Reproducible Proof
In an isolated lab, feed a benign JavaScript-URL indicator with an HTML5-only whitespace entity through the text filter and compare its stored output with browser URL interpretation. Keep the default SEF article rendering as a negative control, and record whether any alternate consumer preserves the URL. Do not treat unchanged filter output alone as proof of victim execution.
Vulnerable Code
$attrSubSet[1] = html_entity_decode(strtolower($attrSubSet[1]), ENT_QUOTES | ENT_HTML401, &class="tok-comment">#39;UTF-8');
class="tok-comment">// Source report: HTML5-only named entities remain undecoded before scheme checks.Severity
medium
CVSS
5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Technical Analysis
checkAttribute() decodes with ENT_HTML401 and removes literal whitespace before its dangerous-scheme check. The HTML5 named entity 
 remains encoded at that stage. A browser later decodes it and normalizes URL whitespace, causing the browser’s scheme interpretation to differ from the sanitizer’s.
The original report demonstrated stored filter output and browser execution of that output. It also documented a negative control: default front-end article rendering with the SEF plugin rewrites the affected href as a same-origin path, incidentally blocking that particular execution context. Execution therefore depends on how a component renders the filter output.
Related fixed vendor advisory: CVE-2026-92231, HTML5 entity decode mismatch. This CVE association is inferred from the matching technical description; the public advisory credits Netanel Stern for the earlier report. Aria’s finding 10 was independently accepted in ticket #282580.
Original Joomla finding 10. Vendor-confirmed and fixed; see the coordination notes and linked official advisory.
Impact
Confidentiality and integrity: stored JavaScript execution is possible in a consumer/output context that preserves the filtered URL. The filter bypass alone does not establish execution in the default SEF-rewritten article context. No direct availability impact established.
Remediation
Upgrade to Joomla 6.1.4 / 5.4.9 or a later supported release. Normalize relevant HTML5 entities before security-sensitive scheme checks and validate URL semantics consistently with browser behavior. Apply context-appropriate encoding in consumers.
Vendor advisory: https://developer.joomla.org/security-centre/1095-20260915-core-xss-filter-bypass-in-inputfilter-via-html5-entity-decode-mismatch.html
Timeline
- Published
- Advisory published
References
Credits
Independently reported to JSST by Aria Akhavan, Haikhavan, as finding 10. The technically matching public advisory CVE-2026-92231 credits Netanel Stern; the correspondence does not explicitly assign that CVE to this report.