CVE-2026-60033
Received Received - Intake

SSRF in Joomla JMedia Extension

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Joomla! Project

Description
The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-60033
EUVD
EUVD-2026-46055

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomla jmedia *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Joomla extension JMedia has a Server-Side Request Forgery (SSRF) vulnerability. This allows attackers to make the server download files from internal or reserved network addresses by submitting a specially crafted URL.

Detection Guidance

To detect this SSRF vulnerability in JMedia, monitor network traffic for outbound requests to internal or reserved IP addresses from your Joomla server. Check server logs for unusual URL download attempts targeting localhost, private IP ranges, or metadata services. Inspect JMedia's direct URL upload feature for requests to unauthorized hosts.

Impact Analysis

An attacker could exploit this to access internal systems, bypass firewalls, or exfiltrate sensitive data from restricted network segments. It may also lead to unauthorized file downloads or further attacks on internal infrastructure.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the JMedia extension to the latest patched version immediately. Disable remote URL downloads in Joomla configuration if not required. Monitor network traffic for unusual internal requests targeting reserved addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60033. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart