Joomla YouTube Gallery SQLi reads database (CVE-2026-94130) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-94130 is a critical unauthenticated SQL injection in the Joomla YouTube Gallery extension (joomlaboat.com) before version 5.7.3 that lets attackers inject SQL into video search and sorting queries and read arbitrary data from the site’s database. Patched in 5.7.3 - update immediately.

Overview

YouTube Gallery is a Joomla extension that pulls YouTube videos and playlists into a Joomla site. The extension’s video search and sorting functionality passes user-supplied input directly into database queries without proper parameterization. Because these endpoints are reachable without logging in, any remote attacker can send crafted requests and inject SQL commands into read queries.

The flaw carries a CVSS score of 9.3 (NETWORK attack vector, LOW complexity, NONE privileges required, NONE user interaction). No account, no special position on the network, and no victim action are needed. A single HTTP request is enough.

Impact

Successful exploitation lets an attacker read data the Joomla database user can access. Depending on how the site is configured, that can include Joomla user accounts and password hashes, session records, email addresses, and any content stored in the same database. In many shared-hosting setups the Joomla database user also has access to tables from other applications on the same account, widening the exposure.

This is a read-only injection in the current public reporting, but database read access is frequently the first stage of a larger intrusion: harvested admin password hashes and session data enable follow-on account takeover. Unauthenticated SQL injection is also a common target for automated mass scanning, so exposed installations should be treated as high risk even though no active exploitation has been confirmed.

Remediation and Mitigation

• Update YouTube Gallery to version 5.7.3 or later. This is the only complete fix.
• If you cannot patch immediately, disable the extension’s video search and sorting functionality, or unpublish the extension entirely until you can upgrade.
• Restrict access to the vulnerable endpoints with a web application firewall rule as a temporary stopgap; treat this as mitigation, not remediation.
• Review database and web server logs for requests containing SQL keywords or unusual characters in search and sort parameters.
• Rotate Joomla administrator credentials and any database passwords, and invalidate active sessions if you find evidence of probing or exploitation.
• Confirm your Joomla core and all other extensions are current; attackers chain extension flaws with core issues.

Inventory any site running YouTube Gallery before 5.7.3, including staging and forgotten installs. Data breach reports are available at breach reports and ongoing coverage at security news.

Security Insight

This is the second time in recent years that a popular Joomla content extension has shipped an unauthenticated SQL injection through unparameterized search input - a pattern that keeps recurring because extensions are maintained by small teams and tested for functionality, not adversarial input. The CVSS profile here is the worst case: no authentication, no complexity, no user interaction, which makes it trivially scriptable against the long tail of unmaintained Joomla sites. It underlines that Joomla’s core hardening means little when the extension ecosystem remains the softest target in the stack.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs