Joomla keeps a default list of file extensions it treats as dangerous and refuses to accept. SHTML was not on it. On a server configured to process that file type, an attacker who can reach an upload form could put a malicious file there and have the server execute it. Joomla has now closed that gap, along with two access control flaws, in versions 5.4.8 and 6.1.3.
Every release up to and including Joomla 5.4.7 and 6.1.2 is affected. Joomla is one of the most widely deployed content management systems on the internet, and the upload flaw is the one that matters most of the three.
Three flaws, one of them worth hurrying for
CVE-2026-73373 is rated High. It is the missing SHTML entry in the default dangerous file list, and it can lead to code execution wherever the web server actually runs those files.
CVE-2026-73372 is rated Medium. An incorrect access check means contact information belonging to items a user should not be able to see can be included in schema.org markup, exposing restricted details to anyone who reads the page source.
CVE-2026-73371 is also rated Medium. Another incorrect access check could let an unauthorised attacker run batch copy operations on items that should not be editable by them.
No CVSS scores have been published for any of the three. The advisory chain carries only the High and Medium ratings above, and beyond the descriptions here there is no public exploitation detail, so treat the severity ratings rather than a score as the ranking.
Update to 5.4.8 or 6.1.3, internet facing sites first
Move Joomla 5.x installations to 5.4.8 or later and 6.x installations to 6.1.3 or later. Identify and update servers exposed directly to the internet as the priority. Then go back through the logs, both the web server's and Joomla's own, and look for SHTML upload attempts, unauthorised access, and unexplained content copies or modifications. Review user and administrative permissions against least privilege while you are in there, and keep third party extensions and components patched too, because that is where Joomla sites have been hit before. In July, CISA added four critical file upload bugs in Joomla add-ons to its known exploited catalog.
As of publication of the advisory, no active exploitation of these three flaws had been recorded, though that can change quickly once a fix makes the underlying bug public.
Joomla published the fixes in its own security and bugfix release announcement. Spain's national cybersecurity institute INCIBE summarised them as advisory INCIBE-2026-564 on 19 August 2026, and Peru's Centro Nacional de Seguridad Digital relayed that summary in its integrated digital security alert, which is where we picked it up.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.