Alert GCSA-26053 - Aggiornamento di sicurezza per Joomla!

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

alert ID: GCSA-26053
data: 03 aprile 2026
titolo: Aggiornamento di sicurezza per Joomla!

******************************************************************

:: Descrizione del problema

E' stata rilasciata una nuova versione del CMS Joomla!
con la quale vengono corrette alcune vulnerabilita' di sicurezza.

[20260301] - Core - ACL hardening in com_ajax
[20260302] - Core - SQL injection in com_content articles webservice endpoint
[20260303] - Core - XSS vector in com_associations comparison view
[20260304] - Core - XSS vectors in various article title outputs
[20260305] - Core - Arbitrary file deletion in com_joomlaupdate
[20260306] - Core - Improper access check in webservice endpoints

Maggiori dettagli sono disponibili alla sezione "Riferimenti".


:: Software interessato

Joomla! versioni precedenti alla 5.4.4
Joomla! versioni precedenti alla 6.0.4


:: Impatto

Bypass delle funzionalita' di sicurezza (SFB)
SQL Injection (SQLi)
Cross-Site Scripting (XSS)
Attacco all'integrita' dei dati


:: Soluzioni

Aggiornare alle versioni piu' recenti (5.4.4 o 6.0.4)

https://downloads.joomla.org/
https://downloads.joomla.org/latest

Joomla! update instructions
https://docs.joomla.org/Portal:Upgrading_Versions/it


:: Riferimenti

Joomla! Release News
https://www.joomla.org/announcements/release-news/5944-joomla-6-0-4-5-4-4-security-bugfix-release.html

Joomla! Security Announcements
https://developer.joomla.org/security-centre.html
https://developer.joomla.org/security-centre/1027-20260301-core-acl-hardening-in-com-ajax.html
https://developer.joomla.org/security-centre/1028-20260302-core-sql-injection-in-com-content-articles-webservice-endpoint.html
https://developer.joomla.org/security-centre/1029-20260303-core-xss-vector-in-com-associations-comparison-view.html
https://developer.joomla.org/security-centre/1030-20260304-core-xss-vectors-in-various-article-title-outputs.html
https://developer.joomla.org/security-centre/1031-20260305-core-arbitrary-file-deletion-in-com-joomlaupdate.html
https://developer.joomla.org/security-centre/1032-20260306-core-improper-access-check-in-webservice-endpoints.html


Mitre CVE
https://www.cve.org/CVERecord?id=CVE-2026-21629
https://www.cve.org/CVERecord?id=CVE-2026-21630
https://www.cve.org/CVERecord?id=CVE-2026-21631
https://www.cve.org/CVERecord?id=CVE-2026-21632
https://www.cve.org/CVERecord?id=CVE-2026-23898
https://www.cve.org/CVERecord?id=CVE-2026-23899


GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert

-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCac+xOQAKCRDBnEyTZRJg
QpRQAJ921AVKgbiAwBEpJOehMVsUANvqogCgzyh3RiXtbU6Wp8CMusgSzC6Wg1c=
=GkD1
-----END PGP SIGNATURE-----