External risk intelligence

Joomla Zoo Extension Unauthenticated SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-74804

The vulnerability exists in a Joomla extension, which is a component of a web application. Web applications and their associated extensions are commonly deployed as internet-facing services, making this surface reachable to remote, unauthenticated users in typical deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a critical security flaw in a Joomla extension that allows unauthenticated attackers to inject malicious SQL code. This could potentially lead to unauthorized access and manipulation of sensitive data within affected systems. The primary concern is confirming whether this specific extension is in use and exposed to the internet.

Unauthenticated attackers can inject malicious code.
Confirm if this extension is used and internet-exposed.
Assess potential data access and system compromise.

Attack Path

How an attacker could exploit the issue

An attacker could target this vulnerability by sending specially crafted requests to a Joomla website that uses a vulnerable version of the Yootheme Zoo extension. The vulnerability lies in how the `ItemController::element()` function processes user-supplied data for filtering. By manipulating the `filter_type` parameter, an attacker could inject malicious SQL code, potentially leading to unauthorized access or modification of sensitive data within the website's database.

No authentication required.
Vulnerable filter parameter in requests.
Risk of database compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the integrity and availability of systems running the affected Joomla extension by allowing an unauthenticated attacker to manipulate database queries. This could potentially lead to unauthorized data modification or denial of service when supported by the advisory.

Database integrity and availability are at risk.
Unauthenticated remote input manipulation.
Data corruption or service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in a popular Joomla extension impacts applications where this extension is deployed. Owners of Joomla websites, application administrators, and potentially infrastructure teams supporting these sites should prioritize assessment. The first practical step is to identify all instances of the affected extension, determine their exposure and business criticality, and then coordinate remediation with vendor support or an internal maintenance schedule.

Application owners and website administrators.
Verify extension usage and exposure.
Plan coordinated updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Yootheme Zoo extension for Joomla?

Zoo is a content construction kit and application framework built for Joomla. It allows website administrators to create, manage, and display complex content types—such as catalogs, blog posts, or product lists—with custom data fields. By acting as an extension, it bridges the gap between raw database storage and the visual front-end users interact with.

What does SQL injection mean in the context of CVE-2026-74804?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. Simply put, the software fails to sanitize input before using it in database queries. Because the application blindly trusts user-supplied data in the filter parameters, an attacker can append their own malicious SQL commands to the server's database instructions to extract or alter information.

How is this SQL injection triggered?

The flaw is triggered when an attacker sends a specially crafted web request to the ItemController::element() function in a vulnerable version of Zoo. By injecting code into the 'filter_type' request parameter, they manipulate how the system queries the database. Notably, simply viewing standard pages or interacting with non-filtered content does not trigger this vulnerability; it requires specific, malicious input designed to alter query logic.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal flags this as a likely risk because the Zoo extension is a component of a web application. Since web applications are frequently configured as internet-facing services to reach users, the entry point for this SQL injection is often reachable by remote, unauthenticated actors. If your Joomla site exposes these Zoo-based pages to the public internet, the attack surface is significantly increased.

What should I do if I use the Zoo extension?

Your first step is to audit your Joomla environment to identify every instance of the Zoo extension currently in use. Determine which of these sites are internet-facing and contain sensitive data. Once you have an inventory, coordinate with your technical team to apply the vendor's update, ensuring you move beyond version 4.1.64 to remediate the underlying query handling flaw.

References

www.yootheme.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.