A lack of output processing in Joomla! download views lets an attacker inject arbitrary HTTP response headers, creating a reflected file download or content‑type confusion scenario. The injected headers can mislead browsers or downstream systems into treating the response as a different file type or causing a misleading download prompt, potentially enabling phishing or download‑based attacks.

The vulnerability affects Joomla! CMS versions 3.0.0 through 5.4.7 and 6.0.0 through 6.1.2, as distributed by the Joomla! Project.

The CVSS score of 4.8 indicates moderate severity. No EPSS value is available, so the exploitation probability cannot be precisely quantified. Because the issue is not listed in the CISA KEV catalog, publicly known exploits are not reported. The likely attack vector involves crafting a download URL that contains malicious header content, which requires that the target site runs one of the affected Joomla! versions and that the download view is accessible.