Vik Booking 1.18.21 stops guests saving script as a check-in signature

On 11 November 2026 E4J released Vik Booking 1.18.21 for Joomla, the fourth security release for the hotel booking extension in 22 days. The changelog gives the security work three short lines: “SVG and images sanitising techniques”, “Various CSRF and capability checks added” and “Various fixes and value escapings applied”. It does not say what was wrong, or who could reach it.

The first of those lines covers a flaw a guest could reach. Until 1.18.21 a guest with a confirmed booking could submit an SVG containing script as their check-in signature, and Vik Booking saved it unchanged in a folder under /administrator/ on the site’s own domain. The fix is E4J’s work. The detail below comes from the public WordPress build of the same code, which E4J release on the same day.

TL;DR

• E4J released Vik Booking 1.18.21 for Joomla on 11 November 2026, with WordPress build 1.8.21 the same day and an identical changelog
• It is the fourth security release in 22 days: 1.18.17 (20 October), 1.18.18 (21 October), 1.18.19 (26 October) and now 1.18.21
• The guest signature feature accepted an SVG and wrote it to disk as it arrived. A guest with a confirmed booking could store script in a .svg file served from the site’s own domain. It runs only when someone opens the file URL directly
• The back-end invoice tasks had no CSRF token check and no permission check. Both were added
• No CVE for either. Our CVSS 4.0 assessment is 5.1 Medium for each
• Across the Joomla sites we manage that run Vik Booking, about 62% are below 1.18.17 and have missed all four releases

What changed in Vik Booking 1.18.21

Vik Booking 1.18.21 for Joomla pairs with 1.8.21 of the WordPress plugin, and the code comments say so directly: “@since 1.18.21 (J) - 1.8.21 (WP)”. Beyond the three security lines, the changelog lists four changes that support them:

• “New transient tokens model.”
• “New booking details SID default format with dedicated hook for adopting a custom format.”
• “New configuration setting for keeping certain guests related media files above the web-root directory.”
• “New configuration setting “booking details link expiration days”.”

The remaining lines are features: PMS reports, door access codes and a task manager hook.

How a Vik Booking guest signature became a script file

Vik Booking lets a guest sign at check-in. The front-end task storesignature and the pre-check-in controller, site/controllers/checkin.php, take the signature as a base64 data URI and accept three types: png, jpg or jpeg, and svg. A code comment dates that format list to 1.15.1.

Before 1.18.21 the decoded bytes were written to disk as they arrived. The file went into administrator/components/com_vikbooking/resources/idscans/, a folder inside the web root, named after the booking id, the booking SID and the customer id, with its extension taken from the submitted type. An SVG is an image format that can contain script, so an SVG with script inside it became a .svg file served from the site’s own domain.

The code sets conditions. The request needs a valid CSRF form token, which anyone on the signature page has. The booking’s sid and ts must match, its status must be “confirmed”, its check-out must not have passed, and a customer record must be linked to it. No Joomla account is involved. Getting a confirmed booking can mean making an ordinary one and, on sites that take payment up front, paying for it.

What keeps this at Medium is how the script fires. The site and administrator pages show the signature through an <img> tag, which does not run script. It runs when someone opens the file URL directly, for example from a link they are sent. Because the file is under /administrator/ on the site’s own origin, a logged-in administrator who opens it gives the script their session.

How did Vik Booking 1.18.21 fix the signature upload?

A new function, VikBooking::sanitizeImageBytes(), checks that the bytes match the declared type. For an SVG it rejects any DOCTYPE or ENTITY declaration, then rebuilds the image with DOMDocument from an allowlist of drawing tags in the SVG namespace: svg, g, path, polyline, polygon, line, rect, circle and ellipse. Any other tag or attribute is removed. The function is applied in storesignature, in the pre-check-in controller and in the back-end createcheckindoc task.

The new configuration setting goes further and moves guest media files above the web root altogether. They are then served through a new mediafiles controller that requires a token and the core.vbo.bookings permission.

Two smaller front-end changes sit alongside. Values submitted in the booking form’s custom fields now go through strip_tags, and the field keys of the front-end inquiry form are filtered to letters, digits, underscore and hyphen. Booking extensions take files and free text from strangers by design, and Vik Booking is not the only one caught out by it: Events Booking had its own unauthenticated upload problem.

The back-end invoice tasks in Vik Booking 1.18.21

“Various CSRF and capability checks added” covers the administrator side. The invoice tasks geninvoices, resendinvoices and downloadinvoices gained a CSRF token check and a core.vbo.management permission check. Before, a logged-in administrator could be tricked into a request from another site that generated, re-sent or downloaded invoices, and a back-end user without the management permission could reach the same tasks.

Creating a booking from the calendar view now needs a token and the core.vbo.bookings permission, and creating rates from the tariffs view now needs a token. Several back-end views gained output escaping as well.

Four Vik Booking security releases in 22 days

The run started with 1.18.17 on 20 October 2026. 1.18.18 followed on 21 October with “Fixes applied for the automated security plugin review findings.”, and 1.18.19 on 26 October with “XSS prevention with custom fields management functions.” 1.18.21 on 11 November makes four in 22 days.

There is no Joomla 1.18.20. The WordPress build had a 1.8.20 on 27 October, listing “Fixed invalid capability check affecting front-end pages.” and “Security improvements.”, and the front-end change we saw in it was the booking room-options parameter being validated as numeric. The Joomla numbering goes straight from 1.18.19 to 1.18.21.

We covered the first three releases in the 1.18.19 post.

Vik Booking 1.18.19 is its third security release in a week, with fixes for Vik Rent Car and Vik Rent ItemsVik Booking 1.18.19, Vik Rent Car 1.15.13 and Vik Rent Items 1.8.6 fix a CSRF gap and stored XSS. Three Vik Booking security releases in a week. What changed.Read the full post

How many sites have taken the Vik Booking updates?

More than a third took the last one, and most have taken none. Across the Joomla sites we manage that run Vik Booking, about 37% were on 1.18.19 on the day 1.18.21 came out, up from about 9% on 26 October, the day 1.18.19 was released. None were on 1.18.21 yet.

The other 63% are still below 1.18.19, and nearly all of them, about 62% of the total, are below 1.18.17. Those sites have missed all four releases in the run. About 36% are below 1.18.0.

“SVG and images sanitising techniques” reads like housekeeping, and an owner deciding whether an update can wait until next month has nothing else to go on. A security release note should say what was fixed, who could reach it and which versions are affected. After fifteen years of looking after client sites, I would put vague release notes near the top of the reasons an important update gets put off.

What to do

1. Update Vik Booking to 1.18.21 on every Joomla site that runs it.
2. After updating, turn on the new setting that keeps guest media files above the web root.
3. Look in administrator/components/com_vikbooking/resources/idscans/ for .svg signature files. Open none of them in a browser. Read them as text and check for script.
4. Treat any site below 1.18.17 as four security releases behind, not one.

How mySites.guru flags Vik Booking below 1.18.21

mySites.guru added a rule to its vulnerability database on 11 November 2026, and every connected Joomla site running Vik Booking below 1.18.21 now shows it on its dashboard. The rule sits beside the 26 October one for versions below 1.18.19, so a site behind both shows both advisories.

Joomla itself gives no security flag on an extension update, so 1.18.21 appears in the update list looking like any other release. The update can go out across the flagged sites with the mass updater, whether you look after a handful of sites or a large portfolio of Joomla sites, and it is part of every subscription.