CVE-2026-66917: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joomgalleryfriends.net JoomGallery extension for Joomla

CVE-2026-66917 is a stored XSS vulnerability in the JoomGallery extension for Joomla, affecting versions 4.0.0 to 4.3.0 inclusive. The flaw allows an authenticated, privileged user to embed malicious JavaScript payloads into images. When other users view these images, the injected script executes in their browsers, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Successful exploitation enables an attacker with authenticated privileged access to execute arbitrary JavaScript in the context of any visitor's browser who views the compromised images. This can lead to theft of sensitive information, session hijacking, or other malicious actions within the user's browser session. The vulnerability does not require user interaction beyond viewing the affected content and has a high impact on confidentiality, integrity, and availability of user sessions.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileged user access to trusted individuals only and consider disabling or limiting image upload features if feasible.