Alert GCSA-26242 - Aggiornamento di sicurezza per Joomla!

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   alert ID: GCSA-26242
       data: 30 settembre 2026
     titolo: Aggiornamento di sicurezza per Joomla!

******************************************************************

:: Descrizione del problema

   Sono state rilasciate nuova versioni del CMS Joomla!
   con le quali vengono corrette 16 vulnerabilita',
   delle quali 5 hanno un livello di impatto "alto".

   [20260901] - Core - XSS in HTMLHelper::link method
   [20260902] - Core - Unauthorized user account creation via profile.save controller
   [20260903] - Core - Improper ACL checks for access level webservice endpoints
   [20260904] - Core - XSS in the generic media output layouts
   [20260905] - Core - Arbitrary directory deletion via cache purge action
   [20260906] - Core - Improper ACL checks in content history comparison view
   [20260907] - Core - Improper ACL checks in outputs for tagged items
   [20260908] - Core - XSS in HTML Mail Templates
   [20260911] - Core - XSS in link toolbar layout
   [20260909] - Core - SSRF vectors in various core extensions
   [20260910] - Core - Improper ACL checks for workflow stage changes
   [20260912] - Core - XSS in module list
   [20260913] - Core - Improper ACL checks for varous webservice edit tasks
   [20260914] - Core - MFA Authentication Bypass through rememberme cookies
   [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch
   [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs

   Maggiori dettagli sono disponibili alla sezione "Riferimenti".


:: Software interessato

   Joomla! versioni dalla 1.5.0 alla 5.4.8
   Joomla! versioni dalla 6.0.0 alla 6.1.3


:: Impatto

   Cross-site Scripting (XSS)
   Bypass delle funzionalita' di sicurezza (SFB)
   Attacco all'integrita' dei dati (Data Manipulation)
   Accesso a dati riservati (ID)


:: Soluzioni

   Aggiornare alle versioni piu' recenti (5.4.9, 6.1.4)

   https://downloads.joomla.org/cms
   https://downloads.joomla.org/latest
   https://downloads.joomla.org/cms/joomla5/5-4-9
   https://downloads.joomla.org/cms/joomla6/6-1-4


:: Riferimenti

   Joomla! Release News
   https://www.joomla.org/announcements/release-news/joomla-6-1-4-5-4-9-security-bugfix-release.html

   Joomla! Security Announcements
   https://developer.joomla.org/security-centre/

   Mitre CVE
   https://www.cve.org/CVERecord?id=CVE-2026-90906
   https://www.cve.org/CVERecord?id=CVE-2026-90907
   https://www.cve.org/CVERecord?id=CVE-2026-90913
   https://www.cve.org/CVERecord?id=CVE-2026-90914
   https://www.cve.org/CVERecord?id=CVE-2026-90915
   https://www.cve.org/CVERecord?id=CVE-2026-90916
   https://www.cve.org/CVERecord?id=CVE-2026-90917
   https://www.cve.org/CVERecord?id=CVE-2026-90918
   https://www.cve.org/CVERecord?id=CVE-2026-92224
   https://www.cve.org/CVERecord?id=CVE-2026-92222
   https://www.cve.org/CVERecord?id=CVE-2026-92223
   https://www.cve.org/CVERecord?id=CVE-2026-92225
   https://www.cve.org/CVERecord?id=CVE-2026-92226
   https://www.cve.org/CVERecord?id=CVE-2026-92227
   https://www.cve.org/CVERecord?id=CVE-2026-92231
   https://www.cve.org/CVERecord?id=CVE-2026-92232


GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert

-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCarz+sgAKCRDBnEyTZRJg
QiPfAKDJPBMcjEmOqT9VV0vmoVyBKvbRKgCgqPOeXEUaFau744nS5JN+SgZbX5M=
=za7Y
-----END PGP SIGNATURE-----