This vulnerability (CVE-2026-48954) in Joomla! CMS involves improper neutralization of input during web page generation, specifically in the language override feature. It allows a cross-site scripting (CWE-79) attack vector due to insufficient input validation. The CVSS 4.0 base score is 5.9 (medium severity), with network attack vector, low attack complexity, high privileges required, and user interaction needed. The vulnerability affects Joomla! CMS versions 3.0.0 through 5.4.6 and 6.0.0 through 6.1.1. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with high privileges to execute cross-site scripting attacks via the language override feature, potentially impacting confidentiality and integrity of user sessions or data. However, exploitation requires user interaction and high privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to high-privilege accounts and avoid enabling or using the language override feature if possible. Monitor official Joomla! Project communications for updates.