{"id":"CVE-2026-102786","kind":"vulnerability","aliases":["CVE-2026-102786"],"related":[],"title":"Joomla Phoca Gallery: authenticated users can store script via HTML attributes","description":"Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5","summary":"Phoca Gallery (com_phocagallery) 4.5.0 to 6.1.5 puts EXIF GPS values from uploaded images into the front-end photo info view without escaping. A crafted image breaks out of an HTML attribute and runs script for anyone who opens that photo's info page, including an admin. The attacker needs to get an image into a gallery: back-end upload rights, or front-end user upload, which is off by default. Fixed in 6.1.6 on the Joomla 6 line only. The Joomla 4 (4.5.5) and Joomla 5 (5.1.3) lines have no fixed release, and the updater offers them as if current.","severity":"high","cvss":8.6,"epss":0.00444,"exploited":false,"exploited_at":null,"products":[{"name":"Phoca Gallery","fixed":["6.1.6"],"affected":">= 4.5.0, <= 6.1.5","ecosystem":"joomla"}],"ecosystems":["joomla"],"tags":["joomla","package","phoca-gallery","self-hosted","xss"],"not_affected_if":["phoca-gallery-not-installed","version-6.1.6-or-later","version-outside-4.5.0-6.1.5"],"how_to_check":"In Joomla admin go to System > Manage > Extensions and find Phoca Gallery. Any version from 4.5.0 to 6.1.5 is affected. On Joomla 4 and 5 the updater may show no update or offer 4.5.5 or 5.1.3, both still vulnerable. Check the version by eye. Also review images uploaded by accounts you do not recognise, and whether front-end user upload was ever enabled.","fix":"Joomla 6: update Phoca Gallery to 6.1.6 and confirm the version. Joomla 4 or 5: back up, then install the 6.x package by hand (may mean moving to Joomla 6 first), or remove the component. Until then, disable front-end user upload and restrict gallery upload rights.","status":"open","published_at":"2026-10-23T15:17:22+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-23T22:39:11+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:39:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Joomla Phoca Gallery: authenticated users can store script via HTML attributes","impact":"medium","summary":"Phoca Gallery, a Joomla extension from phoca.cz, versions 4.5.0 through 6.1.5 fail to sanitize input placed into HTML attributes. A logged-in user can store JavaScript that runs in the browser of anyone who views the affected page.","category":"package","who_cares":["joomla","phoca-gallery","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs scripts in admin or visitor browsers, stealing sessions","analyst_note":"Check the Phoca Gallery vendor advisory or NVD page for the fixed version and whether the flaw is reachable by low-privilege accounts.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["phoca-gallery-not-installed","version-outside-4.5.0-6.1.5"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000482,"input_tokens":2878,"output_tokens":389,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Phoca Gallery vendor advisory or NVD page for the fixed version and whether the flaw is reachable by low-privilege accounts.","search":"'-102786':14A,17A '-2026':13A,16A '4':114B '4.5.0':33B,149C '4.5.5':115B '5':118B '5.1.3':119B '6':109B '6.1.5':35B,150C '6.1.6':105B 'admin':76B 'anyon':66B 'attack':78B 'attribut':11A,61B,144C 'authent':4A,136C 'back':88B 'back-end':87B 'break':56B 'com':31B 'craft':54B 'cross':139C 'cross-sit':138C 'current':132B 'cve':12A,15A 'default':102B 'end':47B,89B,95B 'escap':52B 'exif':37B 'extens':134C 'fix':103B,123B 'front':46B,94B 'front-end':45B,93B 'galleri':3A,24B,30B,86B,148C 'gallery':19A 'get':81B 'gps':38B 'host':27B 'html':10A,60B,143C 'imag':42B,55B,83B 'includ':74B 'info':49B,72B 'inject':145C 'joomla':1A,20B,108B,113B,117B,133C 'line':110B,120B 'need':79B 'offer':128B 'open':68B 'packag':21B 'page':73B 'phoca':2A,18A,23B,29B,147C 'phoca-galleri':22B 'phoca.cz':135C 'phocagalleri':32B 'photo':48B,70B 'put':36B 'releas':124B 'right':91B 'run':63B 'script':8A,64B,141C 'self':26B 'self-host':25B 'site':140C 'store':7A,137C 'updat':127B 'upload':41B,90B,97B 'user':5A,96B 'valu':39B 'via':9A 'view':50B 'without':51B 'xss':28B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102786","severity":null,"published_at":"2026-10-23T15:17:22+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-102786:473","url":null,"severity":null,"published_at":"2026-10-23T23:35:21+00:00","modified_at":"2026-10-23T23:35:21+00:00","first_seen_at":"2026-10-23T23:35:21+00:00","fetched_at":"2026-10-23T23:35:21+00:00","note":"Vendor release post (phoca.cz 6.1.6) confirms the security fix; the detail (EXIF GPS fields unescaped in site/views/info/view.html.php) comes from the mySites.guru diff analysis, not the vendor. Fix reaches the Joomla 6 line only. No PoC or exploitation found; X and HN not searched."},{"source":"epss","external_id":"CVE-2026-102786","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102786","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[{"id":2054,"url":"https://www.phoca.cz/news/1531-phoca-gallery-version-6-1-6-released-security-release","title":"Phoca Gallery Version 6.1.6 Released - Security Release","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2055,"url":"https://mysites.guru/blog/phoca-gallery-exif-stored-xss/","title":"Phoca Gallery 6.1.6 fixes a stored XSS hidden in a photo's EXIF data (mySites.guru)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2056,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102786","title":"CVE Record: CVE-2026-102786","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}