CVE-2026-77989: Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1
Published Aug 27, 2026
·Updated
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.
Affected Software
1 affected component
Joomla Events Manager<5.0.1
Event History
Aug 27, 2026
CVE Published
via MITRE·05:43 AM
Data Sourced
via MITRE·05:43 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Joomla Events Manager versions earlier than 5.0.1 are affected. The issue is in the PDF export link generation and rendering path.
2
What does an attacker need to exploit this issue?
An attacker needs to cause a victim to use a request with a crafted query string. The query string is copied into the PDF button URL and echoed without escaping, allowing reflected script injection.