Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88855

OrdaSoft Joomla Gallery free extension for Joomla · SQL injection

CVSS 4.0 8.6 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88855

Published

Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88855

Published

com_osgallery_light

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_osgallery_light",
                    "product": "OrdaSoft Joomla Gallery free extension for Joomla",
                    "vendor": "OrdaSoft.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-6.2.6"
                        }
                    ]
                }

com_osgallery

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_osgallery",
                    "product": "OrdaSoft Joomla Gallery extension for Joomla",
                    "vendor": "OrdaSoft.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-6.2.6"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON