CVE-2026-66917

The CVE reports stored XSS in JoomGallery 4.x image metadata fields requiring an authenticated privileged user. This is a trust-island vulnerability: the extension treats image metadata (alt text, descriptions, custom fields) as semantically distinct from user-submitted text, applying sanitization logic inconsistently across content types. The result is that metadata embedded in binary content reaches output unencoded, executing in every visitor's browser. For defenders, the priority is determining exactly which metadata field accepted the payload and whether the 4.4.0 patch addresses only that field or represents a comprehensive output encoding pass. Examine the diff: a single htmlspecialchars() addition to one field indicates a targeted fix that likely leaves other image metadata fields (custom fields, category descriptions, tag metadata) vulnerable. If the patch shows systematic encoding across multiple field handlers, the root cause was more likely addressed. Check your JoomGallery version immediately — anything below 4.4.0 is affected. Beyond the immediate patch, assess your Content Security Policy. If a nonce-based CSP is in place for admin-inserted content, this payload may have been blocked regardless. If not, CSP deployment is a compensating control that addresses the class of vulnerability, not just this instance. The 'privileged user' requirement should not reduce urgency. In CMS contexts, 'privileged' typically means author or content manager — accounts that are primary targets for phishing, credential stuffing, and insider threats. Once compromised, this XSS becomes the delivery mechanism for the second-stage attack chain: credential compromise → author account → stored XSS → all visitors → session hijacking. The blast radius cascades from the initial account compromise, not from the XSS in isolation. Finally, verify whether JoomGallery is actively maintained. CMS extensions have high abandonment rates, and an unmaintained extension with this vulnerability pattern (image metadata as trust island) is a structural risk that no single patch fully resolves. Document this dependency in your inventory and monitor for maintenance activity.

Reviewed through automated stages and approved by a human before publication.