Joomla is the awkward one. Most CMSs stamp their version into the generator meta tag - Joomla stamps in its name and nothing else. So the trick here isn't reading the meta tag, it's knowing where Joomla does leak the version. Spoiler: it's a file anyone can open.
Quickest way: run a full scan
Point ScanTower's full scan at the URL and it goes straight for the source that actually has the number:
| Signal | Source | Confidence | Value |
|---|---|---|---|
| Version manifest | /administrator/manifests/files/joomla.xml | 98 / 100 | Joomla 4.2.7 |
That manifest is the most reliable Joomla tell there is, and the scan then checks the release against published CVEs.
What the meta tag does and doesn't say
View source and you'll find this on almost every Joomla site:
<meta name='generator' content='Joomla! - Open Source Content Management' />Useful for confirming it's Joomla. Useless for the version - there isn't one in there.
Where the version actually leaks
The reliable spot, readable without logging in despite the path, is the install manifest:
curl -s https://example.com/administrator/manifests/files/joomla.xml | grep -i versionThat returns a <version> tag with the exact release. On Joomla 4 and 5 the /language/en-GB/langmetadata.xml file is a good backup, and older sites often still have /README.txt with the version at the top.
Why confidence isn't 100
A careful admin can block access to the manifest and language files. When they do, you fall back to fingerprinting the core JavaScript and template behaviour - less precise, but enough for a version range. The full scan handles that fallback automatically.
Why the version matters: CVEs
Joomla's version is really one question - has it been patched? A few that have done real damage:
| CVE | Type | Affected | Fixed in |
|---|---|---|---|
| CVE-2023-23752 | Unauthenticated info disclosure (leaks DB credentials via the API) | 4.0.0 - 4.2.7 | 4.2.8 |
| CVE-2017-8917 | Pre-auth SQL injection | 3.7.0 | 3.7.1 |
| CVE-2015-8562 | Unauthenticated remote code execution (object injection) | 1.5.0 - 3.4.5 | 3.4.6 |
CVE-2023-23752 is the one to take seriously today - it was mass-scanned within days and hands attackers the site's database credentials with a single unauthenticated request. And note that Joomla 3.x is end of life, so anything still on it gets no fixes. Confirm the exact range against the Joomla Security Centre before acting.
If it's your site
- Update. Use the built-in Joomla Updater (System → Update). On Joomla 3, plan the move to 5 - it's past EOL.
- Block the manifest and language XML files, or at least don't leave them world-readable.
- Re-scan to confirm the version moved and the CVE flags cleared.
While you're at it, the security headers checker and HTTP security checker catch the misconfigurations that tend to come with an out-of-date CMS. On something else? Same write-ups for Drupal, Ghost and WordPress.