JMedia Extension CVE-2026-60033

Q: What is the CVSS score of CVE-2026-60033?

CVE-2026-60033 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46055 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-20 Joomla

GHSA-m6w9-xrpw-cw98

SSRF Jmedia Extension For Joomla Themexpert Com

5.1

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

PR:H reflects administrator-level access required to trigger remote-URL download; S:C and C:L/I:L capture SSRF reach into internal systems with no direct impact on the host.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:29 vuln.today

DescriptionCVE.org

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses.

AnalysisAI

Server-Side Request Forgery in the JMedia Extension for Joomla (themexpert.com) allows authenticated administrators to direct the extension's remote-URL download feature to issue server-side HTTP requests to internal or reserved IP address ranges, effectively using the Joomla host as a network proxy. With high privilege required (PR:H per CVSS 4.0 vector) and no direct impact on the vulnerable system itself (VC/VI/VA all N), real-world risk is primarily limited to internal network reconnaissance and interaction with co-located services. No public exploit code and no CISA KEV listing exist at time of analysis.

Technical ContextAI

JMedia is a media manager Joomla CMS extension developed by themexpert.com (CPE: cpe:2.3:a:themexpert.com:jmedia_extension_for_joomla:*:*:*:*:*:*:*:*). The root cause is CWE-918 (Server-Side Request Forgery): the extension's remote-URL download functionality passes a user-supplied URL to a server-side HTTP client without validating or blocking destinations corresponding to RFC 1918 private ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses. The CVSS 4.0 subsequent-system impact metrics (SC:L/SI:L/SA:L) capture SSRF's characteristic behavior: the vulnerable Joomla installation itself sustains no confidentiality, integrity, or availability loss, but it becomes a proxy capable of reaching internal infrastructure not otherwise accessible to the attacker.

RemediationAI

Consult the vendor advisory at https://www.themexpert.com/joomla-extensions/joomla-media-manager and upgrade to the patched version of JMedia once released - no exact fixed version number was confirmed in the available data, so verify current patch status directly with the vendor before acting. As an immediate compensating control, restrict Joomla administrator access to the minimum necessary set of trusted accounts, since the PR:H requirement means the attack surface is bounded by administrator credential exposure. Configure network egress filtering or a WAF on the Joomla host to block outbound HTTP connections to RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) - note that overly broad egress rules may interfere with legitimate external media fetch operations and should be tuned against the extension's expected traffic. If the remote-URL download feature is not operationally required, disabling it entirely within JMedia is the most effective workaround and eliminates the attack surface completely.