The JoomCCK extension for Joomla contains an SQL injection vulnerability identified as CVE-2026-49048. The issue arises because a front-end controller task builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterization. This improper neutralization of special elements in SQL commands (CWE-89) can be exploited remotely without authentication, leading to high confidentiality impact. The affected versions are from 1.0 through 6.4.0. There is no vendor advisory or patch currently available to address this vulnerability.

An attacker can exploit this vulnerability to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, no required privileges or user interaction, and high confidentiality impact. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable front-end controller task if possible or apply custom input validation and sanitization to mitigate injection risks.