JDownloads CVE-2025-55758

Exploitation requires a victim who is already authenticated to a Joomla site running the JDownloads component (versions 1.0.0 through 4.0.47) to be tricked into interacting with attacker-controlled content (UI:R) - e.g., clicking a crafted link or loading a malicious page - while their session is active. The CSRF nature means the attacker cannot act directly; they rely entirely on riding the victim's existing authenticated session. Limiting factors: the requirement for an active, logged-in victim and user interaction substantially reduces real-world exploitability, and the flaw presupposes JDownloads is installed (not a default Joomla component). No special server configuration is named as a prerequisite in the description.

This is a moderate-severity, low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4) describes a cross-site request forgery (CWE-352) flaw: the attacker needs no credentials of their own (PR:N) but DOES require user interaction (UI:R) - a logged-in Joomla user or administrator must be lured into triggering the forged request. Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability impact. All exploitation signals point AWAY from urgency: EPSS is only 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. The signals are consistent rather than conflicting - a genuinely low-probability, user-interaction-gated web-app flaw. The one caveat is scope: 'multiple CSRF attack vectors' are referenced but not enumerated, so the true blast radius across JDownloads functions is not quantifiable from the available data. Treat as routine patch-management rather than emergency remediation.

An attacker crafts a malicious web page or email containing a hidden request targeting a JDownloads function and lures a currently-authenticated Joomla user or administrator into visiting it (UI:R). The victim's browser silently submits the forged request under their session, performing an unintended state-changing action such as altering download entries or settings. No public proof-of-concept exploit was identified at time of analysis, and network-reachable, low-complexity delivery makes phishing-style luring the realistic vector.