Joomla! CMS versions 3.0.0 to 5.4.6 and 6.0.0 to 6.1.2 contain a vulnerability identified as CVE-2026-71572, categorized under CWE-93 (Improper Neutralization of CRLF Sequences). The issue arises from insufficient output processing in the download views, which permits injection of CRLF sequences into HTTP response headers. This can lead to response header injection, enabling reflected file download or content-type confusion attacks. The CVSS v4.0 base score is 4.8, indicating medium severity. No known exploits are reported in the wild, and no official patch or vendor advisory detailing remediation is provided in the input data.

The vulnerability allows an attacker with high privileges and partial user interaction to inject CRLF sequences into HTTP response headers in Joomla! CMS download views. This can result in reflected file download or content-type confusion, potentially misleading users or causing improper handling of downloaded content. The impact is limited by the requirement for high privileges and user interaction, and no evidence of active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, administrators should monitor Joomla! Project advisories for updates. Until a fix is available, restrict access to affected download views to trusted users and consider additional output validation or filtering as a temporary mitigation.