The vulnerability arises from missing output filtering in Joomla's HTMLHelper::link method. When an attacker can supply untrusted input that is passed to this method, the function concatenates the value into an anchor tag without proper escaping, enabling the injection of arbitrary scripts that will execute in a visitor's browser. The impact is limited to the victim’s session but could lead to session hijacking, defacement, or covert data exfiltration. The weakness corresponds to CWE‑79, a classic reflected input validation flaw.

The Joomla! CMS is affected in the 1.5.0 through 5.4.8 releases and the 6.0.0 through 6.1.3 releases, as listed by the Joomla! Project. No other vendor versions are reported.

The measured CVSS base score is 5.9, indicating moderate severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The flaw would likely be exploited over the network when a user visits a page that includes crafted data in a link, so the attack vector is inferred to be remote web‑based. Successful exploitation requires the attacker to deliver the malicious payload through a location the application accepts as link content – such as a database field or form input that is later rendered by HTMLHelper::link.