---
id: "CVE-2026-102786"
kind: "vulnerability"
aliases: ["CVE-2026-102786"]
title: "Joomla Phoca Gallery: authenticated users can store script via HTML attributes"
severity: "high"
cvss: 8.6
epss: 0.00444
exploited: false
status: "open"
category: "package"
products: [{"name": "Phoca Gallery", "fixed": ["6.1.6"], "affected": ">= 4.5.0, <= 6.1.5", "ecosystem": "joomla"}]
ecosystems: ["joomla"]
tags: ["joomla", "package", "phoca-gallery", "self-hosted", "xss"]
not_affected_if: ["phoca-gallery-not-installed", "version-6.1.6-or-later", "version-outside-4.5.0-6.1.5"]
published_at: "2026-10-23T15:17:22+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102786", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:35:21+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-102786", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Joomla Phoca Gallery: authenticated users can store script via HTML attributes

Phoca Gallery (com_phocagallery) 4.5.0 to 6.1.5 puts EXIF GPS values from uploaded images into the front-end photo info view without escaping. A crafted image breaks out of an HTML attribute and runs script for anyone who opens that photo's info page, including an admin. The attacker needs to get an image into a gallery: back-end upload rights, or front-end user upload, which is off by default. Fixed in 6.1.6 on the Joomla 6 line only. The Joomla 4 (4.5.5) and Joomla 5 (5.1.3) lines have no fixed release, and the updater offers them as if current.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- joomla:Phoca Gallery affected >= 4.5.0, <= 6.1.5 fixed 6.1.6

## How to check

In Joomla admin go to System > Manage > Extensions and find Phoca Gallery. Any version from 4.5.0 to 6.1.5 is affected. On Joomla 4 and 5 the updater may show no update or offer 4.5.5 or 5.1.3, both still vulnerable. Check the version by eye. Also review images uploaded by accounts you do not recognise, and whether front-end user upload was ever enabled.

## Fix

Joomla 6: update Phoca Gallery to 6.1.6 and confirm the version. Joomla 4 or 5: back up, then install the 6.x package by hand (may mean moving to Joomla 6 first), or remove the component. Until then, disable front-end user upload and restrict gallery upload rights.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102786
- 2026-10-23T23:35:21+00:00 analyst — Vendor release post (phoca.cz 6.1.6) confirms the security fix; the detail (EXIF GPS fields unescaped in site/views/info/view.html.php) comes from the mySites.guru diff analysis, not the vendor. Fix reaches the Joomla 6 line only. No PoC or exploitation found; X and HN not searched.
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-102786

## Documents

- [advisory] CVE Record: CVE-2026-102786 https://www.cve.org/CVERecord?id=CVE-2026-102786
- [describes] Phoca Gallery 6.1.6 fixes a stored XSS hidden in a photo's EXIF data (mySites.guru) https://mysites.guru/blog/phoca-gallery-exif-stored-xss/
- [fix] Phoca Gallery Version 6.1.6 Released - Security Release https://www.phoca.cz/news/1531-phoca-gallery-version-6-1-6-released-security-release

## From the sources

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_