Summary
CVE-2026-74804 is an unauthenticated SQL injection vulnerability in the Zoo (com_zoo) extension for Joomla, affecting ItemController::element(). The flaw allows unauthenticated attackers to manipulate SQL queries via request parameters, exposing restricted content and database contents. It carries a CRITICAL severity rating of 9.3.
Technical details
- Root cause: the
filter_typerequest parameter and thetype_filterarray are concatenated directly into the SQLWHEREcondition string used byItemController::element(), without quoting or escaping. - The unsanitized condition string is passed down and appended to the underlying database query verbatim.
- Attack vector: network, reachable via a normal HTTP request to the item element endpoint — no authentication, form submission, or user interaction required.
- Impact: attackers can bypass query filters to retrieve unpublished or login-restricted items, and can append UNION-based SQL to extract arbitrary database contents (e.g., database name, DBMS version), affecting confidentiality, integrity, and availability.
Affected software
- Zoo extension for Joomla (com_zoo), versions 1.0.0 through 4.1.63 (includes the entire 3.x line).
Severity
- CVSS v4.0 Base Score: 9.3 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: upgrade the Zoo extension to version 4.1.65 or later, which addresses this issue along with two other unauthenticated vulnerabilities (an arbitrary file upload/RCE flaw and an open redirect) disclosed in the same release.
- If unable to patch immediately, restrict or disable public access to the affected Zoo item-listing/filter endpoints at the web server or WAF layer until the update can be applied.
- After patching, review the
images/zoo/uploads/directory and database for signs of prior exploitation or unauthorized file uploads.

