CVE-2026-94130 is an unauthenticated SQL injection in the YouTube Gallery extension for Joomla, rated 9.8. It affects versions before 5.7.3 and sits in the video search and sorting features. Update the extension to 5.7.3 or later from the vendor, joomlaboat.com, on every Joomla site you run.
What's affected
- Product: YouTube Gallery, a Joomla extension from joomlaboat.com.
- Affected: versions before 5.7.3.
- Fixed: 5.7.3. The extension's product page lists 5.7.3 as its current version.
- Entry points: video search and sorting, which the record says allowed SQL commands in read queries.
How to check if you're exposed
In the Joomla administrator, open Extensions, then Manage, and filter by the name YouTube Gallery. The version column shows what is installed. Check every Joomla site you run, including staging copies and old sites that are still online.
What to do now
- Update YouTube Gallery to 5.7.3 or later on every site.
- If you cannot update straight away, unpublish the extension's menu items and modules or disable the component until you can.
- Review web server logs for odd search or sorting parameters on pages that use the gallery.
- Rotate the database user's password if you see signs of probing, and check for new or changed administrator accounts.
- Remove the extension from sites that do not use it.
Why it matters
The record lists CWE-89. Search and sort values reach a database query without being neutralized, so a crafted value can change what the query does. The record says the injected commands run in read queries, which puts stored content, user records and password hashes at risk of disclosure.
Because the endpoint needs no login, any visitor can reach it, which explains the 9.8 score. The record does not mark the CVE as exploited in the wild. Joomla sites often carry many small extensions, and each one adds to the patching list, so an inventory is worth the time.
Quick check
Do I need to update if my gallery pages are unpublished?
Possibly not for exposure, but update anyway. The component code stays installed, and it is better to remove or patch it than to depend on a menu setting.
Sources
Last reviewed: 19 October 2026.
