CVE-2026-88855 SQL injection in OrdaSoft Joomla Gallery extension for Joomla
Authenticated users with core.manage permissions can execute SQL queries to read or modify database contents, including user password hashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88855?
CVE-2026-88855 is a high-severity SQL injection vulnerability in OrdaSoft.com OrdaSoft Joomla Gallery extension for Joomla, published on 20 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.
Weakness: CWE-89
Which versions are affected by CVE-2026-88855?
How do I fix CVE-2026-88855?
No fix has been published for CVE-2026-88855 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-88855 being exploited?
There is no known exploitation of CVE-2026-88855 in the wild and no public exploit code.
Sources
Also known as GHSA-qjf3-rwvw-jv5p.