CVE-2026-35221 is a medium severity SQL injection vulnerability (CWE-89) in Joomla! CMS versions 5.4.0-5.4.5 and 6.0.0-6.1.0. The vulnerability is due to improperly built filter clauses in the com_finder search query component, which can be exploited to inject SQL commands. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No official patch or remediation level has been published by the Joomla! Project as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the Joomla! CMS database via the com_finder search query. This could lead to unauthorized data disclosure or modification. However, the CVSS score and vector indicate that the impact is medium severity with high confidentiality impact but no impact on integrity or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the com_finder component or applying any recommended temporary mitigations from the vendor. Monitor Joomla! security advisories closely for updates.