Security
Phoca Gallery flaw exposes Joomla sites to stored XSS
Phoca Gallery versions 4.5.0 through 6.1.5 contain a stored cross-site scripting flaw that can execute code from crafted image EXIF data when a photo’s information view is opened.
mySites.guru published research on the issue, which is tracked as CVE-2026-102786. The Joomla CNA rates it High, with a CVSS 4.0 score of 8.6. An attacker needs a way to upload an image, while the malicious code runs when another visitor views the affected photo. The report says it did not test the attack against live sites.
The problem is classified as stored XSS through HTML attribute injection. Crafted EXIF content can escape the intended markup and run in the site’s browser, potentially affecting an administrator who opens the photo information view.
- Joomla 6 administrators should update Phoca Gallery to
6.1.6and confirm the installed version. - Joomla 4 and 5 administrators should not treat their current
4.5.5or5.1.3packages as fixes. The report recommends installing the6.xpackage manually, moving to Joomla 6 if necessary, or removing the extension. - Sites that enabled front-end uploads should review upload permissions and suspicious images.
Originally reported by mySites.guru.