CVE-2026-60033
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The JMedia extension for Joomla! versions below 1.6.0 is vulnerable to server-side request forgery (SSRF). The remote URL download functionality can be abused to target internal/reserved addresses.
Risk Assessment
The risk is the ability to scan internal networks, access sensitive services, and potentially steal credentials from cloud metadata.
Recommendation
It is recommended to upgrade the JMedia extension to version 1.6.0 or later, which includes a fix for the SSRF vulnerability.
Other vulnerabilities in JMedia
See all- CVE-2026-60034Critical
The Joomla extension JMedia versions below 1.6.0 is vulnerable to stored cross-site scripting (XSS). Unsanitized SVG uploads served without the nosniff header allow an attacker to inject malicious scripts that execute in other users' browsers.
- CVE-2026-60032Critical
The Joomla extension JMedia versions below 1.6.0 is vulnerable to authenticated arbitrary file upload. An authenticated attacker can upload executable files (including with polyglot filenames), and chmod does not strip execute bits, leading to remote code execution (RCE).
Original NVD description (English source)
Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses.