How do I check whether I am affected by CVE-2026-102786?

In Joomla admin go to System > Manage > Extensions and find Phoca Gallery. Any version from 4.5.0 to 6.1.5 is affected. On Joomla 4 and 5 the updater may show no update or offer 4.5.5 or 5.1.3, both still vulnerable. Check the version by eye. Also review images uploaded by accounts you do not recognise, and whether front-end user upload was ever enabled.

What is the fix for CVE-2026-102786?

Joomla 6: update Phoca Gallery to 6.1.6 and confirm the version. Joomla 4 or 5: back up, then install the 6.x package by hand (may mean moving to Joomla 6 first), or remove the component. Until then, disable front-end user upload and restrict gallery upload rights.

Who is not affected by CVE-2026-102786?

Not affected if: phoca-gallery-not-installed, version-6.1.6-or-later, version-outside-4.5.0-6.1.5.

Live › vulnerability › CVE-2026-102786

Go to dashboard

high8.6Packagejoomla

Joomla Phoca Gallery: authenticated users can store script via HTML attributes

Phoca Gallery (com_phocagallery) 4.5.0 to 6.1.5 puts EXIF GPS values from uploaded images into the front-end photo info view without escaping. A crafted image breaks out of an HTML attribute and runs script for anyone who opens that photo's info page, including an admin. The attacker needs to get an image into a gallery: back-end upload rights, or front-end user upload, which is off by default. Fixed in 6.1.6 on the Joomla 6 line only. The Joomla 4 (4.5.5) and Joomla 5 (5.1.3) lines have no fixed release, and the updater offers them as if current.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.6

high

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs scripts in admin or visitor browsers, stealing sessions.
CVSS said: 8.6. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-102786

Go to dashboard

high8.6Packagejoomla

Joomla Phoca Gallery: authenticated users can store script via HTML attributes

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

8.6

high

scored by [email protected]

known so far6 of 6

First public: Oct 23, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker runs scripts in admin or visitor browsers, stealing sessions.
CVSS said: 8.6. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Joomla Phoca Gallery: authenticated users can store script via HTML attributes

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Joomla Phoca Gallery: authenticated users can store script via HTML attributes

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources