Joomla

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, rather than for the report. Joomla is a named Tier 1 project, the highest of the two tiers, where the panel grades a merged patch at $500 for a one-liner, $2,000 for a modest improvement, $7,500 for a moderately complex one and $15,000 for a complicated, high-impact change, entirely at its discretion. Patches must be at least one month and no more than twelve months old, maintainers hold a veto, the panel may split the award with them, and sanctions and territory exclusions apply. Latest advisories Loading the feed Overview Joomla runs about 1.2% of all websites, making it the second-largest self-hosted CMS after WordPress and putting it under a long tail of small business, association, education and municipal sites: operators who install it once, extend it with third-party components and then rarely touch it again. That deployment pattern makes core defects durable. An unauthenticated injection in Joomla core is still exploited at scale years after the fix shipped, because a large share of installs never take it. The bug profile leans hard on the classic web classes, led by injection at 28%. The Joomla project pays nothing for a report: [email protected] is a real channel with no money behind it, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The Joomla Security Strike Team takes reports at [email protected] against any supported core release, and the boundary it draws is core against third-party extensions. What follows is the whole of Joomla core Joomla core at the repository Google names in its Tier 1 scope row, github.com/joomla/joomla-cms , which is the only asset the patch pathway reaches The database layer and the query builder in full, the surface Joomla's injection history is best known for The whole output and templating path: the site and administrator templates, the editor and everywhere untrusted data can reach markup unescaped Access control across the bundled com_* components and the ACL that governs them, where an unauthenticated or low-privilege request reaches an administrator-only action or an API endpoint that should be closed The extension installer and the update path, where a fetched package, its manifest or its update URL is trusted before it is executed Session handling and authentication, including the administrator login path and any route that accepts a state-changing request without the token the form layer requires Information disclosure through error output, routing and configuration exposure, where a response leaks credentials, paths or content to a session that should not see it Out of scope Third-party extensions, templates and plugins from the Joomla Extensions Directory, which are separate projects and are not the repository Google's Tier 1 row names Site-specific misconfiguration: a permission an administrator granted, or an ACL set up more broadly than intended PHP itself and bundled upstream libraries, which have their own separate pathways rather than being defects in Joomla core One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude by name along with resource-exhaustion denial of service A patch the maintainers or the Strike Team decline, since the reward panel states it will not second-guess a maintainer's decision Reports that only demonstrate impact with a Super User account already in hand, since that role is inside the trust boundary by design Most-valued findings Unauthenticated SQL injection in core, which is the top class here at 28% and, on a CMS with this many unattended installs, a mass-exploitation event rather than a single-site problem An access-control or authentication bypass that reaches an administrator-only component or a core API endpoint without credentials, the shape that has driven Joomla's most exploited advisories Any chain that turns a low-privilege session into PHP execution on the host, through the extension installer, the update path or file handling Stored cross-site scripting in the administrator interface, where the victim is by definition the account with the most authority on the site A structural fix that makes query building or output escaping safe across a whole subsystem rather than at one call site, which is what the Patch Rewards panel grades at the top of its Tier 1 ladder Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to [email protected] , which is a real channel run by the Joomla Security Strike Team and pays nothing for the report itself Send a detailed, reproducible report against a supported core release, naming the version and the user group the attack starts from Show the bug on core rather than on a third-party extension; an extension finding goes to its developer and is a different process Give the Strike Team room to ship: fixes go out in a core release with a numbered advisory, so hold the detail until that publishes If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month. That is a separate pathway, rate-limited to three submissions a month, with sanctions and territory exclusions of its own Disclosure Coordinated with the Joomla Security Strike Team, which fixes in a core release and publishes a numbered security announcement crediting the reporter. Timing follows the release rather than a fixed clock, and sorona.xyz holds your finding until that announcement is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability