CVE-2026-35222 is a SQL injection flaw in Joomla com_tags, scored 9.8 (Critical) in the CVE record. Improperly validated order clauses are the cause. Joomla says to upgrade to version 5.4.6 or 6.1.1, and the affected range reaches back to Joomla 4.0.0.
What's affected
- Product: Joomla! CMS, component com_tags
- Affected versions: 4.0.0 to 5.4.5 and 6.0.0 to 6.1.0
- Fixed versions: 5.4.6 and 6.1.1
- Joomla's announcement: reported 2026-03-31, fixed 2026-05-26
Joomla 4 sites should note that the announcement lists no fix inside the 4.x line. Plan a move to 5.4.6 or later. The Joomla announcement calls this an authenticated blind SQL injection with severity Moderate and low probability, while the CVE record scores it 9.8. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Your Joomla version is shown under System, System Information in the administrator. You can also read it from the files:
grep -E "MAJOR_VERSION|MINOR_VERSION|PATCH_VERSION" libraries/src/Version.php
Compare the result with the affected ranges above. Joomla 5.4.6 and 6.1.1 are the fixed releases named in the project's announcement.
What to do now
- Upgrade to Joomla 5.4.6 or 6.1.1. Sites still on 4.x need a plan to move to 5.x.
- Back up files and database first.
- Confirm the new version in System Information afterwards.
- Review user accounts and remove those that are no longer needed.
- Check logs for odd requests that include unusual ordering values on tag pages.
Why it matters
The record files this under CWE-89. Order clauses are an easy place for SQL injection to hide because they cannot be passed as bound values in most database drivers. They have to be checked against a list of allowed columns instead. This flaw is a case of that check being incomplete.
Because the range includes Joomla 4, this is also a reminder to look at end of life dates. A site that stays on an old major version may not get a fix for a flaw like this.
Quick check
Why are order clauses a common injection point?
Database drivers bind values, but not column names or sort directions. Code has to validate those against an allow list, and mistakes there lead to injection.
What version should I move to?
Joomla 5.4.6 or 6.1.1, the fixed releases in the announcement.
Sources
Last reviewed: 19 October 2026.
