CVE-2025-54476: Joomla! CMS Vulnerable to XSS via Input Filter
Summary
CVE-2025-54476: Joomla! CMS vulnerable to XSS via the input filter. Affects joomla/filter across 3 version ranges.
< 2.0.6
>= 3.0.0, < 3.0.5
>= 4.0.0, < 4.0.1
Fixed in 2.0.6, 3.0.5 or 4.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Joomla! is a widely used open-source content management system (CMS) that allows users to build and manage websites easily. The 'joomla/filter' package is a crucial component of Joomla! that provides input filtering capabilities to ensure data integrity and security. However, it has been found to have vulnerabilities that can lead to cross-site scripting (XSS) attacks, compromising the security of websites built on this platform.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the checkAttribute method of the input filter framework class. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, leading to potential data theft, session hijacking, or other malicious activities. The severity of this vulnerability is classified as moderate, with a CVSS score of 4.0, indicating that while it requires some level of user interaction, it poses a significant risk to affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.62.0.6composer require joomla/filter:2.0.6 -
>= 3.0.0, < 3.0.53.0.5composer require joomla/filter:3.0.5 -
>= 4.0.0, < 4.0.14.0.1composer require joomla/filter:4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to implement additional input validation and sanitization measures in your application to mitigate the risk of XSS attacks. However, this is not a substitute for applying the official patch.
Conclusion
The CVE-2025-54476 vulnerability in the Joomla! CMS highlights the importance of maintaining updated software to protect against XSS attacks. Users are strongly encouraged to update their 'joomla/filter' package to the latest patched versions to ensure the security of their applications.
See every vulnerability recorded for joomla/filter →
FAQ
CVE-2025-54476 is a vulnerability in the Joomla! CMS that allows for cross-site scripting (XSS) attacks through improper input handling in the input filter framework.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
The risks include potential data theft, session hijacking, and the ability for attackers to execute malicious scripts on affected websites, compromising user security.
Yes, implementing additional input validation and sanitization measures can help mitigate the risk of XSS attacks until a proper update can be applied.
You can find detailed information about Joomla! vulnerabilities on the official Joomla! security website and through vulnerability databases like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for joomla/filter.
