CVE-2026-73373

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.

We have discovered 134,111 live websites that are affected by CVE-2026-73373.

Run a Free Instant Scan



Affected Software

Product  Joomla
Category Content Management System
Vulnerable Domains134,111 live websites (51% of Joomla install base)
Vulnerable Versions
  • from 1 through 3.3.1
  • from 1 through 5.4.7
  • from 4 through 4.2.1
  • from 6 through 6.1.3
Vulnerable Versions Count159 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-434 Unrestricted Upload of File with Dangerous Type



Details

  • Published - Aug 18, 2026
  • Updated - Aug 19, 2026

Credits

  • Valentin Lobstein (Chocapikk) (finder)

Website Distribution by Country

Number of websites using CVE-2026-73373
United States7,788 websites


Italy37,013 websites
Russia11,894 websites
Germany8,093 websites
Kazakhstan7,019 websites
GB5,367 websites
Netherlands5,291 websites
South Africa4,625 websites
Serbia4,294 websites
Sweden3,756 websites

Website Distribution by TLD

Number of websites using CVE-2026-73373
.com29,109 websites
.it24,642 websites
.ru9,890 websites
.de4,528 websites
.nl4,155 websites
.org3,308 websites
.se3,164 websites
.cz3,053 websites
.co.uk2,812 websites
.net2,706 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-73373

Top websites that are affected by CVE-2026-73373. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****.com Italy**,***
************.com United States**,***
************.com Germany**,***
*********************.com United States**,***
******.fr Canada**,***
*****.org United States**,***
************.ru Russia**,***
********.com Slovakia**,***
*****.it Italy**,***
*********.com United States**,***
See full domain list

FAQ

CVE-2026-73373 is Unrestricted Upload of File with Dangerous Type in Joomla
A total of 134,111 websites have been identified as vulnerable to CVE-2026-73373, based on global website indexing conducted by WebTechSurvey.
The Joomla is affected by the CVE-2026-73373 vulnerability.
Joomla versions up to 6.1.3 are vulnerable to CVE-2026-73373.
CVE-2026-73373 is resolved in version 6.1.3 of Joomla.