CVE-2026-100749
MediumCVSS 5.1Summary
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.
Risk Assessment
An attacker can trick an administrator into unknowingly performing cleanup actions, potentially leading to data deletion. This affects data integrity, though the scope is limited to orphaned entries and old carts.
Recommendation
Update the Event Gallery extension to version 6.5.0 or later, which includes CSRF protection for cleanup actions.
Other vulnerabilities in Event Gallery
See all- CVE-2026-97165Medium
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated.
- CVE-2026-97164High
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in 'clear cache' task in Event Gallery extension < 6.5.0 - Using the 'images' parameter of the 'cache.process' task, you can recursively delete any directories that the web server is authorized to write to.
- CVE-2026-100748Medium
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
- CVE-2026-100747Medium
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.
Original NVD description (English source)
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS