---
title: "[20190701] - Core - Filter attribute in subform fields allows remote code execution"
description: "We help designers, developers, hobbyists and business owners get the most out of the Joomla CMS.  Join us at our free monthly meetups, and let us help you with your Joomla projects."
url: "https://www.joomlalondon.co.uk/official-joomla-announcements/20190701-core-filter-attribute-in-subform-fields-allows-remote-code-execution"
date: "2026-09-09T17:58:13+00:00"
language: "en-GB"
---

#  \[20190701\] - Core - Filter attribute in subform fields allows remote code execution

- **Project:** Joomla!
- **SubProject:** CMS
- **Impact:** Moderate
- **Severity:** Low
- **Versions:** 3.9.7 - 3.9.8
- **Exploit type:** Remote Code Execution
- **Reported Date:** 2019-June-20
- **Fixed Date:** 2019-July-09
- **CVE Number: TBA**

### Description

Inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.

### Affected Installs

Joomla! CMS versions 3.9.7 - 3.9.8

### Solution

Upgrade to version 3.9.9

### Contact

The JSST at the [Joomla! Security Centre](https://developer.joomla.org/security-centre.html "Contact the JSST").

**Reported By:** Benjamin Trenkle, JSSTRead more  [http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/6jkIqCFwOTE/787-20190701-core-filter-attribute-in-subform-fields-allows-remote-code-execution.html](http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/6jkIqCFwOTE/787-20190701-core-filter-attribute-in-subform-fields-allows-remote-code-execution.html "[20190701] - Core - Filter attribute in subform fi")

## Schema

```json
{ "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Start", "item": "https://www.joomlalondon.co.uk" }, { "@type": "ListItem", "position": 2, "name": "Official Joomla! Announcements", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements" }, { "@type": "ListItem", "position": 3, "name": "[20190701] - Core - Filter attribute in subform fields allows remote code execution", "item": "https://www.joomlalondon.co.uk/official-joomla-announcements/20190701-core-filter-attribute-in-subform-fields-allows-remote-code-execution" } ] }
```