This vulnerability (CVE-2026-48950) in Joomla! CMS is due to improper neutralization of input during web page generation (CWE-79). Specifically, the lack of escaping in the file management view of the com_templates component allows cross-site scripting attacks. The CVSS 4.0 base score is 5.9 (medium severity) with network attack vector, low attack complexity, no privileges required for attack initiation but high privileges for exploitation, and user interaction required. The vulnerability affects versions =4.0.0-5.4.6 and =6.0.0-6.1.1. No vendor advisory or patch information is currently available.

An attacker with high privileges and requiring user interaction could exploit this vulnerability to execute arbitrary scripts in the context of the affected Joomla! CMS instance. This could lead to session hijacking, defacement, or other malicious actions depending on the context of the executed script. The vulnerability does not require elevated privileges to initiate but does require high privileges to exploit, limiting the scope of impact to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, administrators should monitor Joomla! Project advisories for updates. Until a fix is released, restricting access to the affected component and limiting user privileges may reduce risk.