CVE-2026-40383 is a local file inclusion flaw in Joomla core, scored CVSS 9.8. Improper validation of user input in the HTMLView layout parameter allows a file to be included. Joomla fixed it in 5.4.6 and 6.1.1. Upgrade now. Check your branch first.
What's affected
From the Joomla Security Centre announcement dated 2026-05-09 (fixed 2026-05-26):
- Affected: Joomla 3.2.1 through 5.4.5, and 6.0.0 through 6.1.0
- Fixed: 5.4.6 and 6.1.1
- Rated by Joomla as high impact and high severity, with low probability
Joomla lists the exploit type as local file inclusion and says it was reported by Doyensec in collaboration with Claude and Anthropic Research.
How to check if you're exposed
Open the Joomla administrator panel, where the version appears in the footer and under System Information. From the command line, the version is defined in the libraries folder:
grep -rn "RELEASE\|MAJOR_VERSION\|MINOR_VERSION" libraries/src/Version.php
If you are on Joomla 3 or 4, note that the advisory range reaches back to 3.2.1 and the fixes are listed for the 5.4 and 6.1 lines. Check the Joomla announcement for the release that applies to your line.
What to do now
- Update to 5.4.6 or 6.1.1, depending on your branch. Back up files and database first.
- If you run Joomla 3 or 4, check the Security Centre and plan a move to a supported branch.
- Update third party extensions at the same time.
- Review web logs for odd values in the layout parameter on requests to your site.
- Enable a web application firewall rule set if you already run one, as a second layer.
Why it matters
The weakness is CWE-22, path traversal, which here leads to local file inclusion. The application accepts a value that selects a layout file, and it does not check that the value stays inside the intended folder. That can pull other files on the server into the page.
Content management systems are exposed by design and are scanned constantly, so fixes for this class deserve a quick window. The record does not report exploitation in the wild.
Quick check
Which version should I install?
5.4.6 on the 5.4 branch or 6.1.1 on the 6.1 branch, per the Joomla announcement.
Sources
Last reviewed: 19 October 2026.
