CVE-2018-6377: Joomla com_fields input filtering flaw enables stored XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is remotely reachable with no privileges and a high EPSS score, though it requires user interaction and no known exploitation is confirmed.

What it is

Joomla before 3.8.4 fails to filter input adequately in the com_fields component, allowing cross-site scripting through the list, radio and checkbox field types. Because custom fields are commonly rendered on public pages, injected script can run in the browser of any visitor viewing the affected field.

Impact

An attacker can execute arbitrary script in a victim's browser session, enabling session theft, credential capture, or actions performed as the victim. The CVSS scope change indicates the compromise can extend beyond the vulnerable component.

Attack surface

Reached over the network through the com_fields component; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so the victim must view or interact with the crafted field content.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.565 (99th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade Joomla to 3.8.4 or later, which fixes the com_fields filtering issue.
• If immediate upgrade is not possible, restrict who can create or edit custom fields and review existing field definitions for injected markup.
• Apply output encoding or sanitization to custom field values rendered in templates.
• Deploy a web application firewall rule to block script payloads in com_fields parameters as a temporary control.

Detection

• Search Joomla custom field configuration and content for script tags, event handlers, or javascript: URIs in list, radio and checkbox values.
• Review web server and application logs for requests to com_fields endpoints containing encoded script payloads.
• Monitor for unexpected administrator or session activity originating from pages that render custom fields.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.