CVE-2026-35221 is a SQL injection flaw in the search query of Joomla com_finder, scored 9.8 (Critical) in the CVE record. Improperly built filter clauses are the cause. The Joomla security team says to upgrade to version 5.4.6 or 6.1.1, depending on your major version.
What's affected
- Product: Joomla! CMS, component com_finder (Smart Search)
- Affected versions: 5.4.0 to 5.4.5 and 6.0.0 to 6.1.0
- Fixed versions: 5.4.6 and 6.1.1
- Joomla's announcement: reported 2026-03-31, fixed 2026-05-26
The Joomla announcement titles this as an authenticated blind SQL injection and rates severity Moderate with moderate probability. The CVE record scores it 9.8 with no privileges required. The two ratings disagree, so read the announcement and decide with your own exposure in mind. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Your Joomla version is shown under System, System Information in the administrator. You can also read it from the files:
grep -E "MAJOR_VERSION|MINOR_VERSION|PATCH_VERSION" libraries/src/Version.php
Compare the result with the affected ranges above. Joomla 5.4.6 and 6.1.1 are the fixed releases named in the project's announcement.
What to do now
- Upgrade Joomla to 5.4.6 or 6.1.1, whichever matches your major version.
- Take a backup of the site files and database before the update.
- After the update, confirm the version in System Information.
- If you cannot update today, review which accounts exist on the site and remove unused ones.
- Check web server logs for unusual requests to Smart Search pages around and after the disclosure date.
Why it matters
SQL injection happens when request values end up inside a database command without being safely bound. The record files this under CWE-89. Here the filter clauses for the search query were built improperly.
Joomla powers a lot of small business and community sites, and many of them update late. A database flaw in a core component matters because it is in the base product, not in an optional add-on. Updating the core is a normal maintenance task, so do it as one.
Quick check
Which Joomla versions fix this?
5.4.6 and 6.1.1, according to the Joomla security announcement.
Is this flaw exploited in the wild?
The record does not say so and the CVE is not in the CISA catalog.
Sources
Last reviewed: 19 October 2026.
