CVE-2026-92222

Joomla has disclosed that URLs used for server-side requests were improperly validated in various core extensions, creating SSRF vectors (CWE-918) affecting Joomla 4.0.0-5.4.8 and 6.0.0-6.1.3. The flaw is triggered when the site performs an outbound fetch based on a URL supplied through an affected core component, tricking the server into requesting internal or otherwise unreachable network resources. Because the CVSS vector indicates high privileges required, exploitation realistically involves an authenticated backend user (e.g., a manager or administrator) abusing a URL-fetching core feature, rather than an anonymous internet attacker. Successful exploitation lets the attacker scan and interact with the internal network from the web server's position — including services meant to be private — with the scoring reflecting high impact on both the vulnerable system and subsequent systems. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and there are no reports of in-the-wild exploitation.

What to do: Upgrade immediately to the fixed Joomla releases issued with the 2026-09-09 security announcement — i.e., a version newer than 5.4.8 on the 5.x branch or newer than 6.1.3 on the 6.x branch. As defense-in-depth, apply egress filtering on the web server so PHP cannot reach private IP ranges, link-local addresses, or cloud metadata endpoints (169.254.169.254), and audit backend user accounts and logs for unusual URL-fetch activity from low-trust managers or administrators.