CVE-2026-90906 is a cross-site scripting flaw in the link method of Joomla's HTML helper. It affects Joomla 1.5.0 through 5.4.8 and 6.0.0 through 6.1.3. NVD scores it High (8.3), while Joomla rates it Moderate. The fix is Joomla 5.4.9 or 6.1.4.
What's affected
Joomla's announcement lists the affected versions as 1.5.0 to 5.4.8 and 6.0.0 to 6.1.3, and names 5.4.9 and 6.1.4 as the releases to upgrade to. The NVD record uses the same ranges. The announcement gives a fixed date of 25 September 2026.
The weakness is CWE-79, cross-site scripting. The record's vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L, which means the attacker needs high privileges and a victim has to interact, but a successful attack crosses a security boundary.
The two sources differ on severity. The NVD record scores 8.3 (High). Joomla's own announcement lists impact Moderate, severity Moderate and probability Low. Both are worth knowing: the score reflects what script in an administrator's browser could do, and the project's rating reflects how hard it is to arrange.
How to check if you're exposed
In the Joomla administrator, open System, then System Information, and read the Joomla version. Any version below 5.4.9 on the 5.x line, or below 6.1.4 on the 6.x line, is in scope. Joomla 4.x and earlier are inside the affected range too, and those branches should be moved onto a supported line.
Also check third-party extensions and templates that call the link helper with values taken from users. Joomla's fix addresses the core method, but custom code that passes unescaped values around is a separate exposure you can find by searching your code for calls to it.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update to Joomla 5.4.9 or 6.1.4 through the Joomla update component, after taking a backup.
- If you run a branch older than 5.x, plan a move to a supported release, since the advisory names only 5.4.9 and 6.1.4 as fixed.
- Limit high-privilege accounts and require two-factor authentication for them.
- Review custom templates and extensions for output that is not escaped.
Why it matters
The announcement says the link method of the HTML helper lacks escaping. When a helper that builds markup does not escape what it is given, any caller that passes user-influenced text can end up writing script into a page. Cross-site scripting in an administrative context is serious because the script runs with the viewer's rights.
The vector shows why the NVD score is high even though the project calls it Moderate. A changed scope and high confidentiality and integrity impact push the number up, while the need for high privileges and user interaction explains the project's more cautious label. The KEV flag in the record is false and Joomla does not report exploitation.
Try it yourself
Joomla and its extensions ship fixes often. This demo shows how continuous watching keeps you ahead of new advisories for the stack you run.
Click through it at your own pace, or open it full screen.
Quick check
Which Joomla versions fix it?
The announcement names 5.4.9 and 6.1.4.
Why is the score High if Joomla says Moderate?
NVD scored 8.3 on its CVSS 3.1 vector. Joomla's rating weighs how likely and how easy exploitation is. Both appear in the sources.
Sources
Last reviewed: 18 October 2026.
