The vulnerability arises from a flaw in the cleanAttribute method within Joomla's InputFilter that removes disallowed HTML data URIs. By inserting whitespace characters before the data URI scheme, an attacker can bypass this sanitization and inject arbitrary script code into attributes. This gives rise to a classic client‑side code‑execution vulnerability, allowing an attacker to execute malicious JavaScript in users' browsers. The weakness is classified as CWE‑79, consistent with reflected or stored cross‑site scripting.

Affected products are the Joomla! CMS and the Joomla! Framework Filter package. The vulnerability applies to Joomla versions 1.5.0 through 5.4.8, as well as 6.0.0 through 6.1.3. Any site running an unpatched instance within these version ranges is potentially at risk.

The CVSS base score of 7.1 indicates a high likelihood of exploitation and significant impact on confidentiality, integrity, and availability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Attackers can trigger the flaw by providing crafted input in publicly accessible fields, such as comments, search boxes, or URL parameters, without authentication. Because the exploit relies solely on injected whitespace characters, the barrier to entry is low, making it a practical threat for both automated scanners and human attackers.