Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-73373, describes an unrestricted upload of SHTML files due to their absence from the default list of dangerous files in Joomla! Core versions 1.0.0-5.4.7 and 6.0.0-6.1.2. This could lead to code execution on servers configured to execute SHTML.
My analysis focused on identifying the code responsible for file upload validation. I located libraries/src/Filesystem/File.php, which contains the upload method, a clear entry point for file uploads. This upload method explicitly calls Joomla\CMS\Filter\InputFilter::isSafeFile to determine if a file is safe.
Further investigation into libraries/src/Filter/InputFilter.php revealed the isSafeFile method and the FORBIDDEN_FILE_EXTENSIONS constant. This constant is the definitive list of file extensions considered dangerous by Joomla's input filter. The core of the vulnerability lies in the fact that, in the vulnerable versions, 'shtml' was missing from this FORBIDDEN_FILE_EXTENSIONS list.
Therefore, Joomla\CMS\Filter\InputFilter::isSafeFile is the function that directly failed to identify 'shtml' as a dangerous file type, and Joomla\CMS\Filesystem\File::upload is the function that invoked this insufficient check during the file upload process. The fix would involve adding 'shtml' to the FORBIDDEN_FILE_EXTENSIONS constant, which is evident in the current version of the InputFilter.php file I fetched. The identified functions are critical components in the file upload and validation workflow, making them direct indicators of the vulnerability's exploitation in a runtime profile.
Joomla\CMS\Filter\InputFilter::isSafeFilelibraries/src/Filter/InputFilter.php
Joomla\CMS\Filesystem\File::uploadlibraries/src/Filesystem/File.php