CVE-2026-102777
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Joomla extension Event Gallery versions < 6.6.0 contains a server-side request forgery vulnerability in the Google Photos picker on the back-end upload page. The picker fetches thumbnails of picked images through the server, using the OAuth access token of the Google Photos account. The task takes the address from the request without checking it and asks for no form token. A prepared page on another web site could make the server send the access token to any address, or fetch addresses inside the server's network, in the name of a logged in administrator.
Risk Assessment
SSRF may lead to OAuth token leakage and access to internal network resources, potentially compromising confidentiality and integrity.
Recommendation
Update the Event Gallery extension to version 6.6.0 or later, which adds URL validation and requires a form token.
Other vulnerabilities in Event Gallery
See all- CVE-2026-102778Medium
In the Joomla Event Gallery extension versions below 6.6.0, there is XSS and open redirect on the share mini page. The article address from the shared link is printed without checking or escaping, and with the link type "Image Page with Redirect" it follows the address immediately.
- CVE-2026-102776Medium
In the Joomla Event Gallery extension versions below 6.6.0, eight tasks called by back-end list buttons do not check the form token. A prepared page on another site could trigger them in the name of a logged-in administrator and change settings and flags.
- CVE-2026-97165Medium
Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated.
- CVE-2026-97164High
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in 'clear cache' task in Event Gallery extension < 6.5.0 - Using the 'images' parameter of the 'cache.process' task, you can recursively delete any directories that the web server is authorized to write to.
- CVE-2026-100749Medium
Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.
- CVE-2026-100748High
Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
- CVE-2026-100747Medium
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.
Original NVD description (English source)
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos account. The task took the address to fetch from the request without checking it and asked for no form token. A prepared page on another web site could therefore make the server send the access token of the account to any address, or fetch addresses inside the server's network, in the name of a logged in administrator; a back-end user with the permission "Manage" could do the same directly. The token is valid for about an hour and reaches what the picker session of the account reaches.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS