CVE-2026-48952 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in Joomla! CMS. It arises from a lack of proper escaping in the update list view of the com_installer component, which can lead to cross-site scripting attacks. The vulnerability affects Joomla! CMS versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.1. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been stated in the available data, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker with high privileges and partial user interaction to execute arbitrary scripts in the context of the affected Joomla! CMS instance, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS vector. However, exploitation requires user interaction and some privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Joomla! Project advisories for updates. Until a patch is available, limit access to the com_installer component to trusted users and consider applying any recommended temporary mitigations from the vendor.