Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7,…

Joomla! Project Joomla! CMS

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

Still cooking for Joomla! CMS and Joomla! Framework Filesystem package.

First seen: 10 Nov 2026
Last update: 10 Nov 2026, 15:17 UTC
Identifiers: CVE-2026-73373
CVSS: 9.8
Source: news
On the menu as: Drupal / Joomla

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7,…
Severity: critical. Patch status: fix status unknown.
Affected: Joomla! Project Joomla! CMS
Ids: CVE-2026-73373

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

## Steps
1. Search the repo, its CI and infra config for Joomla! Project Joomla! CMS. If present, report the version in use and whether it's affected.
2. Joomla! CMS 6.0.x, 1.0.x; Joomla! Framework Filesystem package 4.0.x, 1.0.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Joomla! CMS 6.0.x, 1.0.x | not named in the CVE record | check the vendor advisory: https://developer.joomla.org/security-centre/1077-20260810-core-unrestricted-uploads-of-shtml-files.html | restrict network access to it |
| Joomla! Framework Filesystem package 4.0.x, 1.0.x | not named in the CVE record | check the vendor advisory: https://developer.joomla.org/security-centre/1077-20260810-core-unrestricted-uploads-of-shtml-files.html | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-73373") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://developer.joomla.org/security-centre/1077-20260810-core-unrestricted-uploads-of-shtml-files.html https://nvd.nist.gov/vuln/detail/CVE-2026-73373
https://pwned.coffee/i/joomla-core-20260810-unrestricted-uploads-of-shtml-files-cve-2026-73373

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Joomla! CMS = 6.0.0-6.1.2 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 10 Nov
Joomla! CMS = 1.0.0-5.4.6 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 10 Nov
Joomla! Framework Filesystem package = 4.0.0-4.2.0 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 10 Nov
Joomla! Framework Filesystem package = 1.0.0-3.3.0 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 10 Nov
The CVE record names no fix for 4 lines; the vendor’s advisory may: developer.joomla.org
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (NVD) for CVE-2026-73373
Last checked: 10 Nov 2026, 15:18 UTC

Product	Affected	Fixed in	Source
Joomla! CMS	= 6.0.0-6.1.2	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 10 Nov
Joomla! CMS	= 1.0.0-5.4.6	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 10 Nov
Joomla! Framework Filesystem package	= 4.0.0-4.2.0	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 10 Nov
Joomla! Framework Filesystem package	= 1.0.0-3.3.0	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 10 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee