CVE-2025-55758

MediumCVSS 5.4

Published: 28/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.

Risk Assessment

The risk is that an attacker can perform unauthorized actions in the context of an administrator, potentially leading to configuration changes or data integrity compromise.

Recommendation

Update the JDownloads component to the latest version that includes fixes for the CSRF vulnerabilities.

Other vulnerabilities in JDownloads

CVE-2026-61900Critical
The Joomla extension JDownloads versions below 4.1.6 contains an unauthenticated arbitrary file upload vulnerability. This allows a remote attacker to upload any file without authentication, leading to full remote code execution (RCE).

Original NVD description (English source)

Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS