CVE-2026-102778 Cross-site scripting in Event Gallery for Joomla
Attackers can execute scripts or redirect users via crafted links in the Event Gallery extension when article sharing is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-102778?
CVE-2026-102778 is a medium-severity cross-site scripting vulnerability in svenbluege.de Event Gallery for Joomla, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option "Share article links" is on. It took the address of the article from the shared link and printed it into the page without checking or escaping it; with the link type "Image Page with Redirect" it followed the address at once. A prepared link could therefore run a script in the page, in the session of the visitor who opened it, or send the visitor to another web site. Nothing on the server is changed or read by the server.
Which versions are affected by CVE-2026-102778?
It affects 1 product.
Products include Svenbluege Event Gallery.
How do I fix CVE-2026-102778?
No fix has been published for CVE-2026-102778 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-102778 being exploited?
There is no known exploitation of CVE-2026-102778 in the wild and no public exploit code.
Other vulnerabilities in svenbluege.de Event Gallery for Joomla
- CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0
- CVE-2026-100748 Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
- CVE-2026-102777 Server-side request forgery in Event Gallery for Joomla
- CVE-2026-97165 Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0
- CVE-2026-102776 Cross-site request forgery in Event Gallery for Joomla
Sources
Also known as GHSA-r52h-f94x-72vr.