CVE-2026-73373: Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
Affected Software
Event History
Frequently Asked Questions
Which Joomla versions are affected?
Joomla installations in versions 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are affected because the default dangerous-file list did not block SHTML uploads.
What conditions are required for code execution?
Exploitation requires an attacker to be able to upload an SHTML file and for the hosting server to execute SHTML files. The described impact is code execution under those server conditions.
Is a default Joomla configuration affected?
The issue affects Joomla's default dangerous-file list, which did not include SHTML files. Exposure is therefore relevant where SHTML uploads are permitted and the server executes that file type.