CVE-2025-54476: Joomla! CMS vulnerable to XSS via the input filter
Improper handling of input could lead to a cross-site scripting (XSS) vector in the checkAttribute method of the input filter framework class.
Other sources
Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.
— NVD
Joomla! CMS vulnerable to XSS via the input filter
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/joomla/filterto a version that resolves this vulnerability.Fixed in 2.0.6 - Upgrade
Upgrade
composer/joomla/filterto a version that resolves this vulnerability.Fixed in 3.0.5 - Upgrade
Upgrade
composer/joomla/filterto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54476?
CVE-2025-54476 has been assessed as a medium severity vulnerability due to its potential for XSS attacks.
How do I fix CVE-2025-54476?
To mitigate CVE-2025-54476, update to the latest version of Joomla! Core that addresses input handling issues.
What causes CVE-2025-54476?
CVE-2025-54476 is caused by improper input handling in the checkAttribute method of Joomla!'s input filter framework.
Who is affected by CVE-2025-54476?
Users running affected versions of Joomla! Core are at risk of exploitation through XSS vectors.
Is CVE-2025-54476 an XSS vulnerability?
Yes, CVE-2025-54476 allows for cross-site scripting (XSS) attacks due to inadequate content filtering.