CVE-2026-77028

CVE-2026-77028 is a dual vulnerability in the Zoo extension for Joomla: the redirect parameter is both an open redirect and a reflected XSS vector, meaning the same unvalidated input is echoed unsafely into two distinct output contexts. If you're running Zoo, check whether your version precedes 4.1.66 — that's the fix. But the deeper issue is what this vulnerability reveals about how redirect parameters are handled across the Joomla extension ecosystem. The redirect parameter occupies a security boundary that developers routinely mishandle. Because the parameter's purpose is to send a user somewhere else, developers treat it as 'not really user input' — the application 'intended' the redirect, so the value must be safe. That's invisible trust transfer, and it's why the same parameter fails in two contexts: developers test the happy path (the redirect works) but miss the cross-context failure (the same value executes as JavaScript when echoed into a page). Automated scanners catch this pattern routinely, but developers without security training triage the findings as low-priority noise because the redirect 'actually works.' The CVSS 5.3 score compounds the problem. 'Medium' gets deprioritized, and many Zoo installations are on legacy versions that won't receive the 4.1.66 update because they lack active maintenance. The vulnerability doesn't just have an exposure window at disclosure — it has one at installation, because the vulnerable code shipped with older releases and remains exploitable indefinitely on unmonitored deployments. What to do: audit any extension that handles redirect parameters in your Joomla environment, regardless of CMS version. Look for code that takes a query string or form parameter and passes it directly to a Location header or echoes it into HTML/JS without explicit allowlist validation. If you maintain extensions, treat redirect targets as untrusted input requiring context-aware sanitization — the same value that safely goes into a header can XSS in a script block.

Reviewed through automated stages and approved by a human before publication.