[20260909] - Core - SSRF vectors in various core extensions
Joomla fixed high-severity SSRF CVE-2026-92222 in core extensions, patched in CMS 5.4.9 and 6.1.4.
Joomla disclosed CVE-2026-92222, a high-severity server-side request forgery flaw in several core extensions. URLs used for server-side requests were improperly validated. Affected installs are Joomla CMS 4.0.0–5.4.8 and 6.0.0–6.1.3; the advisory versions line also lists 3.0.0–5.4.8. Exploit probability is rated low. Patches are in 5.4.9 and 6.1.4, reported by Aria Akhavan on 2026-08-24 and fixed on 2026-09-25. No in-the-wild exploitation is stated.
- CVE-2026-92222 is a high-severity SSRF in Joomla core extensions.
- URLs used for server-side requests were improperly validated.
- Affects CMS 4.0.0–5.4.8 and 6.0.0–6.1.3; probability rated low.
- Fixed in Joomla 5.4.9 and 6.1.4; no exploitation reported.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92222 | Server-Side Request Forgery (SSRF) in Joomla CMS Core Extensions | 8.9 | — |
From the original article
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 3. 0.
By Joomla! Security Strike Team · developer.joomla.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.