CVE-2026-65754

UNKNOWN

Published 2026-07-23 · Source security@joomla.org

ReReplacer XML include paths could read files outside the site directory.

CWE-22

Same severity, most recent

CVE-2026-65758
The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.
2026-07-23 · score —
CVE-2026-65757
The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
2026-07-23 · score —
CVE-2026-65756
Shortcut configuration accepted arbitrary inline JavaScript.
2026-07-23 · score —
CVE-2026-65755
Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.
2026-07-23 · score —
CVE-2026-65713
Modals gallery paths could enumerate unintended directories.
2026-07-23 · score —