CVE-2026-74804: Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Q: What attacker access is required to exploit this issue?

No authentication is required. An attacker can supply malicious values through the filter_type request parameter or the type_filter array.

Q: Which deployments are affected?

Zoo versions earlier than 4.1.64 are affected. The issue is in the ItemController::element() handling of filter_type and type_filter input.

Q: What should be prioritized for remediation?

Upgrade Zoo to version 4.1.64 or later. The vulnerable code builds SQL conditions from request values without quoting or escaping them.

Published Aug 19, 2026

Updated

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filtertype request value is interpolated into the query as a.type = "..." and the typefilter array as a.type IN ("..."), with no quoting or escaping.

Affected Software

1 affected component

Joomla Extension - yootheme.com<4.1.64

Event History

Aug 19, 2026

CVE Published

via MITRE·01:35 PM

Data Sourced

via MITRE·01:35 PM

DescriptionWeakness

Frequently Asked Questions

What attacker access is required to exploit this issue?

No authentication is required. An attacker can supply malicious values through the filter_type request parameter or the type_filter array.

Which deployments are affected?

Zoo versions earlier than 4.1.64 are affected. The issue is in the ItemController::element() handling of filter_type and type_filter input.

What should be prioritized for remediation?

Upgrade Zoo to version 4.1.64 or later. The vulnerable code builds SQL conditions from request values without quoting or escaping them.