Skip to content

Releases

v1.0.0 — five verified backports for Joomla 3.10.12

v1.0.0 — five verified backports for Joomla 3.10.12 Latest
Latest

Choose a tag to compare

View all tags
@fstivicic fstivicic released this 09 Nov 08:54
v1.0.0
4d1f840

First release. Five security backports for Joomla 3.10.12.

Read this first — prior art

This is not the only or the most complete option, and you should know that before trusting anyone's patches.

  • PhilETaylor/Joomla3.10.999 — public GPL-2.0, mirrors eLTS releases to 3.10.20-elts. Last commit 17 Feb 2025, so nothing disclosed since.
  • mySites.guru — ongoing Joomla 3 patch tool, free to subscribers, 85 files as of Oct 2026 including 2026 CVEs. Broader coverage than this repo. If you are already a subscriber, use theirs.

This repo adds a standalone, publicly downloadable set with its own probe and CI, for people who are not mySites.guru customers. It is narrower, and makes no claim to be first.

Patched

ID CVE Issue Severity
JSEC-0001 CVE-2026-90906 XSS in HTMLHelper::link() and ::iframe() Medium
JSEC-0002 CVE-2026-90907 Unauthorised account creation via profile.save Medium
JSEC-0003 CVE-2026-73373 Unrestricted upload of .shtml and other executables High
JSEC-0004 CVE-2026-92231 XSS filter bypass via HTML5 entity decode mismatch High
JSEC-0005 CVE-2026-92222 SSRF and local file read via unrestricted feed URL schemes High

JSEC-0005 is outside its advisory's published range (Joomla lists 4.0.0+), because Joomla does not assess EOL branches. mySites.guru reached the same conclusion independently in October 2026. See writeups/version-ranges-lie.md.

Verify

php tests/probe.php /path/to/your/joomla       # is it vulnerable?
php tests/regression.php /path/to/your/joomla  # does ordinary Joomla still work?

Stock 3.10.12: 19 vulnerable vectors. After patching: 0, with 40 regression assertions passing. CI runs both on PHP 7.4, 8.0, 8.2 and 8.3.

Apply

bin/apply.sh /path/to/your/joomla --check   # dry run
bin/apply.sh /path/to/your/joomla

Do not use bare git apply: inside a git repository it resolves paths from the repository root and silently ignores paths outside it, exiting 0 having changed nothing.

Known limits

  • Not a complete audit. Narrower than mySites.guru's set.
  • JSEC-0004's end-to-end exploitability is unproven; the unit-level bypass is real but clean() dropped the payload anyway in both configurations tested.
  • JSEC-0005 does not stop SSRF over HTTP and is input-time only. The advisory includes SQL to audit stored values.
  • One advisory investigated and deliberately not patched — see advisories/NOT-APPLICABLE.md.

Not affiliated with the Joomla project or Open Source Matters, Inc. GPL-2.0-or-later. No warranty — test on a staging copy.

Assets 2
Loading