CVE-2018-12712: Joomla!

High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days.

An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP. In PHP 5.3, this function validates invalid names as valid, which can result in a Local File Inclusion.

Affected products

• Joomla! Joomla!: from 2.5.0, up to and including 3.8.8

Published 2018-06-26. Last modified 2026-06-17.