CVE-2026-73373

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security@joomla.org

Published

2026-08-18

Last modified

2026-10-22

Weaknesses

CWE-434

Affected products

• Joomla! (Joomla)
• Joomla Cms (Joomla Project)
• Joomla Framework Filesystem Package (Joomla Project)

References

• https://www.joomla.org/
• https://developer.joomla.org/security-centre/1077-20260810-core-unrestricted-uploads-of-shtml-files.html