The vulnerability is a cross‑site scripting flaw caused by a lack of escaping in the file management view of the com_templates component. As a result, text that is displayed to a browser can contain unfiltered JavaScript, which an attacker may inject and execute in the victim’s browser when the page is viewed.

The Joomla! CMS from the Joomla! Project is affected, specifically the com_templates component. No specific listed, so any release that has not incorporated the escape fix remains vulnerable.

The CVSS score of 5.9. The EPSS score is less than 1  , and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is exploitation of the file management view, requiring the attacker to provide or alter content that is then rendered to users; this inference is drawn from the description of the missing escaping.