The vulnerability CVE-2026-92232 in Joomla! CMS is a cross-site scripting (CWE-79) flaw caused by improper neutralization of input during web page generation. Specifically, the cleanAttribute method, which is designed to remove HTML data URIs, can be bypassed by injecting whitespace characters within these URIs. This bypass allows an attacker to inject malicious scripts that execute in the context of the affected Joomla! versions. The affected versions include 1.5.0-5.4.8, 6.0.0-6.1.3, 1.0.0-3.0.6, and 4.0.0-4.1.0. The CVSS 4.0 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, and requiring high privileges and user interaction. The impact includes high confidentiality and integrity impact, and high availability impact, with low vulnerability age and no scope change.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute cross-site scripting attacks by bypassing input filtering via whitespace characters in HTML data URIs. This can lead to partial compromise of confidentiality, integrity, and availability of the affected Joomla! CMS instances. The attack requires user interaction and high privileges, reducing the likelihood of widespread exploitation without insider access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the input data, users should monitor Joomla! Project advisories for updates. Until a fix is available, restricting high-privilege user access and avoiding untrusted input in attributes processed by cleanAttribute may reduce risk.