CVE-2026-64799
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Articles Anywhere and Users Anywhere extensions for Joomla! download images from content-controlled URLs without validation, enabling SSRF and file writes to a web-accessible folder.
Risk Assessment
An attacker can access internal network services, read internal data, or place malicious files on the server.
Recommendation
Update the Articles Anywhere and Users Anywhere extensions and implement validation for downloaded images.
Other vulnerabilities in Joomla Extension - Articles Anywhere / Users Anywhere
Original NVD description (English source)
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder.