This vulnerability (CVE-2026-35222) in Joomla! CMS is due to improper neutralization of special elements in SQL commands (CWE-89). Specifically, the com_tags component fails to properly validate order clauses, leading to a SQL injection risk. Affected versions include Joomla! CMS 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required for attack (although the vector states PR:H which means high privileges are required), no user interaction, and high vulnerability and confidentiality impact. The vulnerability is published but no remediation level or patch information is provided.

Successful exploitation could allow an attacker with high privileges to inject malicious SQL commands via the order clause in the com_tags component, potentially compromising data integrity or confidentiality. However, the vulnerability does not allow privilege escalation or availability impact. No known exploits have been reported, and the medium severity score reflects moderate risk.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and monitor for suspicious activity related to the com_tags component. Avoid using affected versions in production environments if possible.