Alert GCSA-26180 - Aggiornamento di sicurezza per Joomla!
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** Alert ID: GCSA-26180 Data: 19 Agosto 2026 Titolo: Aggiornamento di sicurezza per Joomla! ****************************************************************** :: Descrizione del problema Sono state rilasciate nuova versioni del CMS Joomla! con le quali vengono corrette 10 vulnerabilita', delle quali 3 di livello "alto". [20260801] - Core - Response header injection in download views [20260802] - Core - Improper CORS origin validation [20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints [20260804] - Core - Improper ACL checks for custom fields webservice endpoints [20260805] - Core - Improper ACL checks for category webservice endpoints [20260806] - Core - XSS through schema.org outputs [20260807] - Core - MFA Authentication Bypass [20260808] - Core - Improper ACL checks for batch copy actions [20260809] - Core - Improper ACL checks when injection schema.org contact data [20260810] - Core - Unrestricted uploads of SHTML files Maggiori dettagli sono disponibili alla sezione "Riferimenti". :: Software interessato Joomla! versioni dalla 3.0.0 alla 5.4.7 Joomla! versioni dalla 6.0.0 alla 6.1.2 :: Impatto Bypass delle funzionalita' di sicurezza (SFB) Acquisizione di privilegi piu' elevati (EoP) Cross-Site Scripting (XSS) Attacco all'integrita' dei dati (Data Manipulation) :: Soluzioni Aggiornare alle versioni piu' recenti (5.4.8, 6.1.3) https://downloads.joomla.org/cms https://downloads.joomla.org/latest https://downloads.joomla.org/cms/joomla5/5-4-8 https://downloads.joomla.org/cms/joomla6/6-1-3 :: Riferimenti Joomla! Release News https://www.joomla.org/announcements/release-news/joomla-6-1-3-5-4-8-security-bugfix-release.html Joomla! Security Announcements https://developer.joomla.org/security-centre/ Mitre CVE https://www.cve.org/CVERecord?id=CVE-2026-71572 https://www.cve.org/CVERecord?id=CVE-2026-71573 https://www.cve.org/CVERecord?id=CVE-2026-71574 https://www.cve.org/CVERecord?id=CVE-2026-72531 https://www.cve.org/CVERecord?id=CVE-2026-72532 https://www.cve.org/CVERecord?id=CVE-2026-73336 https://www.cve.org/CVERecord?id=CVE-2026-73337 https://www.cve.org/CVERecord?id=CVE-2026-73371 https://www.cve.org/CVERecord?id=CVE-2026-73372 https://www.cve.org/CVERecord?id=CVE-2026-73373 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCaoVb9AAKCRDBnEyTZRJg Qrw6AJ41cTxXk9e3Pd/v42NDK2gt1Q/qkwCeMVrUKvb9KSUaqnvOZd9qlNhQASw= =ocez -----END PGP SIGNATURE-----