This vulnerability (CVE-2026-35221) in Joomla! CMS versions 5.4.0-5.4.5 and 6.0.0-6.1.0 is caused by improperly built filter clauses in the com_finder search query, leading to SQL injection (CWE-89). The flaw allows an attacker with high privileges to inject special SQL elements, potentially manipulating database queries. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, but high vulnerability and confidentiality impact. No official remediation or patch has been disclosed by Joomla! Project as of the published date.

Successful exploitation could allow an attacker with high privileges to manipulate SQL queries within the Joomla! CMS database via the com_finder search component. This may lead to unauthorized data access or modification, impacting confidentiality and integrity. However, no known exploits are reported in the wild, and the vulnerability requires specific conditions to be exploited.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor for updates from Joomla! Project and apply patches promptly once released. Until then, restricting access to the affected components and limiting user privileges may reduce risk.