External risk intelligence

Joomla YouTube Gallery Extension SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-94130

The vulnerability exists in a Joomla extension designed to provide YouTube gallery functionality on websites. Such extensions are typically deployed on public-facing web servers to display content to site visitors, making the video search and sorting features reachable from the internet as part of the standard web application interface.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves an SQL injection vulnerability within a popular Joomla extension that manages YouTube galleries, potentially allowing unauthorized access and manipulation of database information through the video search and sorting features.

Attackers can inject malicious code via search or sort functions.
Affects public-facing website content display.
Confirm if this extension is in use and review its relevance.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing a website that uses a vulnerable version of the YouTube Gallery extension. By interacting with the video search or sorting features, they can inject malicious SQL commands. If successful, this could lead to unauthorized access to or modification of the website's database.

No authentication required.
Triggered via video search or sorting.
Risk of database compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the video search and sorting functionality of the YouTube Gallery extension could allow unauthenticated attackers to inject SQL commands. This could potentially impact the integrity and availability of read queries within the extension's video search feature.

User input in search/sort fields.
Attacker injects SQL commands.
Database integrity and availability risks.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Joomla Extension for YouTube Gallery is likely managed by the application owner or the team responsible for the website's content management system. The first practical step is to identify all instances of this extension within your environment, determine if the video search or sorting features are exposed externally, and then confirm the business criticality and ownership of these instances before planning remediation.

Application owners should lead remediation efforts.
Verify if the extension is deployed and reachable.
Plan updates or vendor engagement for mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Joomla YouTube Gallery extension?

It is a third-party add-on for the Joomla content management system designed to embed and display YouTube video content on websites. Web developers use it to create interactive video galleries, allowing visitors to search, filter, and sort videos directly on a webpage without needing to manage video hosting themselves.

What does SQL injection mean for CVE-2026-94130?

This vulnerability, classified as CWE-89, occurs when the software incorrectly handles user input. An attacker can insert malicious database commands into input fields, such as search or sort parameters. This tricks the application into executing unauthorized queries, potentially exposing or altering data stored in the website's database.

How is this vulnerability triggered?

An attacker triggers this by submitting specifically crafted input into the YouTube Gallery's search or sorting interface. Because this is an unauthenticated flaw, they do not need an account or administrative rights to interact with these features. Simply navigating to the public video gallery and using the search function with malicious parameters is sufficient.

Is my website at risk for CVE-2026-94130?

According to Halo Surface Signal, this extension is typically deployed on public-facing web servers to display content to visitors. Because the video search and sorting features are core components of the public interface, they are inherently reachable from the internet. If you use an affected version, your site is likely accessible to external attackers.

What should I do if I use this extension?

First, conduct an inventory to identify every website or Joomla instance currently running the YouTube Gallery extension. Verify the specific version installed and determine if the affected search or sorting features are active. Once you have a list, coordinate with your site administrators to plan an update or contact the vendor for the official fix.

References

joomlaboat.com/youtube-gallery

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.