Joomla CMS Response Header Injection Vulnerability Advisory (CVE-2026-71572)

Vulnerability Overview Vulnerability ID: CVE-2026-71572 Vulnerability Type: Response Header Injection Severity: Low Probability: Low Report Date: 2026-07-02 Patch Date: 2026-08-18 Impact Scope Affected Versions: Joomla! CMS 3.0.0-5.4.7, 6.0.0-6.1.2 Remediation Solution: Upgrade to version 5.4.8 or 6.1.3 Description A vulnerability in the output processing allows header injection in multiple download views, leading to reflected file downloads or content type confusion. Contact Information Reporter: arib06 Security Center: Joomla! Security Centre Additional Information Project: Joomla! Sub-Project: CMS Exploitation Type: Response Header Injection Page Links Home: Home Security Announcements: Security Announcements Footer Information Copyright: © 2005 - 2026 Open Source Matters, Inc. All Rights Reserved. Technical Support: ROCHEM Navigation Bar Home: Home News: News Project Roadmap: Project Roadmap CMS: CMS Framework: Framework Tracker: Tracker About: About Security: Security Resources Development Strategy: Development Strategy Product Strategy: Product Strategy Planned Features: Planned Features Security Announcements: Security Announcements Report Security Issues: Report Security Issues Generative AI policy: Generative AI policy Usage Statistics: Usage Statistics Statistics API: Statistics API Documentation: Documentation Joomla! API Documentation: Joomla! API Documentation Coding Standards Manual: Coding Standards Manual Joomla!Code Archive: Joomla!Code Archive Mailing Lists Developer Network Newsletter: Developer Network Newsletter General Extensions Mailing: General Extensions Mailing CMS Mailing: CMS Mailing Framework Mailing: Framework Mailing Documentation Mailing: Documentation Mailing Footer Links Home: Home About: About Community: Community Forum: Forum Extensions: Extensions Services: Services User Guide: User Guide Developer: Developer Shop: Shop Accessibility Statement: Accessibility Statement Privacy Policy: Privacy Policy Cookie Policy: Cookie Policy Sponsor Joomla! with $5: Sponsor Joomla! with $5 Help Translate: Help Translate Report an Issue: Report an Issue Log in: Log in Footer Logos DPG: DPG ROCHEN: ROCHEN Footer Copyright Copyright: © 2005 - 2026 Open Source Matters, Inc. All Rights Reserved. Footer Technical Support Technical Support: ROCHEM Footer Links Home: Home About: About Community: Community Forum: Forum Extensions: Extensions Services: Services User Guide: User Guide Developer: Developer Shop: Shop Accessibility Statement: Accessibility Statement Privacy Policy: Privacy Policy Cookie Policy: Cookie Policy Sponsor Joomla! with $5: Sponsor Joomla! with $5 Help Translate: Help Translate Report an Issue: Report an Issue Log in: Log in Footer Logos DPG: DPG ROCHEN: ROCHEN Footer Copyright Copyright: © 2005 - 2026 Open Source Matters, Inc. All Rights Reserved. Footer Technical Support Technical Support: ROCHEM Footer Links Home: Home About: About Community: Community Forum: Forum Extensions: Extensions Services: Services User Guide: User Guide Developer: Developer Shop: Shop Accessibility Statement: Accessibility Statement Privacy Policy: Privacy Policy Cookie Policy: Cookie Policy Sponsor Joomla! with $5: Sponsor Joomla! with $5 Help Translate: Help Translate Report an Issue: Report an Issue Log in: Log in Footer Logos DPG: DPG ROCHEN: ROCHEN Footer Copyright Copyright: © 2005 - 2026 Open Source Matters, Inc. All Rights Reserved. Footer Technical Support Technical Support: ROCHEM Footer Links Home: Home About: About Community: Community Forum: Forum Extensions: Extensions Services: Services User Guide: User Guide Developer: Developer Shop: Shop Accessibility Statement: Accessibility Statement Privacy Policy: Privacy Policy Cookie Policy: Cookie Policy Sponsor Joomla! with $5: Sponsor Joomla! with $5 Help Translate: Help Translate Report an Issue: Report an Issue Log in: Log in Footer Logos DPG: DPG ROCHEN: ROCHEN Footer Copyright Copyright: © 2005 - 2026 Open Source Matters, Inc. All Rights Reserved. Footer Technical Support Technical Support: ROCHEM Footer Links Home: Home About: About Community: Community Forum: Forum Extensions: Extensions Services: Services User Guide: User Guide Developer: Developer Shop: Shop Accessibility Statement: Accessibility Statement Privacy Policy: Privacy Policy Cookie Policy: Cookie Policy Sponsor Joomla! with $5: Sponsor Joomla! with $5 Help Translate: Help Translate Report an Issue: Report an Issue Log in: Log in Footer Logos DPG: DPG ROCHEN: ROCHEN Footer Copyright Copyright: © 2005 - 2026 Open Source Matters, Inc. All Rights Reserved. Footer Technical Support Technical Support: ROCHEM Footer Links Home: Home About: About Community: Community Forum: Forum Extensions: Extensions Services: Services User Guide: User Guide Developer: Developer Shop: Shop Accessibility Statement: Accessibility Statement Privacy Policy: Privacy Policy Cookie Policy: Cookie Policy Sponsor Joomla! with $5: Sponsor Joomla! with $5 Help Translate: Help Translate Report an Is

Goal Reached Thanks to every supporter — we hit 100%!

Joomla CMS Response Header Injection Vulnerability Advisory (CVE-2026-71572)