CVE-2026-60034
CVE-2026-60034 is a critical stored cross-site scripting (XSS) vulnerability in the Joomla JMedia Extension JMedia 1.6.0. The flaw allows an authenticated attacker to upload unsanitized SVG files that are served without the nosniff header, leading to script execution in victims' browsers. Versions of JMedia Extension affecting versions before 1.6.0. Due to unsanitized SVG uploads lacking the nosniff header, an attacker can inject malicious scripts that execute when the file is viewed. Upgrading to version 1.6.0 or later mitigates the issue.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Joomla sites using JMedia Extension versions prior to 1.6.0
Real-world impact
An attacker with legitimate login credentials could upload a malicious SVG file, which when viewed by other users could steal sessions, deface the site, or perform other client-side attacks.
Why this severity
The CVSS v4.0 base score of 9.4 reflects a network‑adjacent attack with low complexity, high privileges required, and high impacts to confidentiality, integrity, and availability.
What to do about it
- 011. Determine the currently installed version of the JMedia Extension.
- 022. If the version is older than 1.6.0, upgrade the extension to version 1.6.0 or later from the vendor (themexpert.com).
- 033. After upgrading, clear any caches and verify that SVG uploads are now properly sanitized or served with the nosniff header.
Remediation steps derived from the NVD description which states the vulnerability exists in JMedia Extension < 1.6.0, implying that version 1.6.0 or later contains the fix.
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 9d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.