Phoca Gallery (Joomla): Stored cross-site scripting via HTML attribute injection
Summary
Phoca Gallery, an image gallery extension for Joomla, versions 4.5.0 through 6.1.5 contain a stored cross-site scripting (XSS) vulnerability caused by HTML attribute injection. An authenticated user who can store gallery content can inject script code that runs in the browsers of other users who view the content, including administrators. This can lead to session theft or unwanted administrative actions. The CVSS vector assumes no privileges, but the description requires an authenticated account, so low-privileged editor accounts may be sufficient.
Affected
- Phoca Gallery extension for Joomla, versions 4.5.0 through 6.1.5
- Default configuration: unaffected (according to the CNA record, affected only in the stated range)
Fixed in
- Phoca Gallery 6.1.6 (security release for Joomla 6)
- Versions for Joomla 4 and 5: Unknown. Confirm the fixed version with phoca.cz before relying on the 4.x or 5.x packages.
Workaround
- Implement a Content Security Policy (CSP) to reduce the impact of script execution. This does not remove the flaw.
- Restrict gallery and image editing rights to trusted users only.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept found; this has not been verified with a dedicated search.
- EPSS score is low (about 0.0026).
Our recommendation
- Check whether Phoca Gallery is installed and which version is used, including Joomla 4 and 5 sites.
- Update to Phoca Gallery 6.1.6 on Joomla 6. For Joomla 4 and 5, confirm the fixed version with phoca.cz.
- Review editor and administrator accounts and remove unused ones.
- If patching is delayed, add a Content Security Policy.
- Monitor for unusual content changes in galleries.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Phoca Gallery 6.1.6 security release (vendor advisory) www.phoca.cz
- Phoca Gallery component download www.phoca.cz
- Phoca Gallery product page www.phoca.cz
- VulDB CVE-2026-102786 vuldb.com
- Vulners CVE-2026-102786 vulners.com
- Strix CVE-2026-102786 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:10.
Original description (NVD)
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.