What is the CVSS score of CVE-2026-64873?

CVE-2026-64873 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Cache Cleaner Pro CVE-2026-64873

EUVD-2026-47897 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-23 Joomla

GHSA-4p75-9px8-9c8r

SSRF Cache Cleaner Pro Extension For Joomla Regularlabs Com

9.8

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-accessible, no privileges or user interaction, and total impact on all CIA aspects in unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 11:58 vuln.today

CVSS changed

Jul 24, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 23, 2026 - 09:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 23, 2026 - 09:14 cve.org

CRITICAL 9.8

DescriptionCVE.org

Custom query URLs could access internal or reserved network services.

AnalysisAI

Server-Side Request Forgery (SSRF) in Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6 allows unauthenticated remote attackers to access internal or reserved network services via crafted custom query URLs. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the vulnerability is automatable and has total technical impact, though no public exploit or active exploitation has been detected. EPSS predicts a 0.18% likelihood of exploitation in the next 30 days.

Technical ContextAI

The issue (CWE-918) is rooted in improper validation of user-controlled URLs that the extension passes to server-side network requests, enabling an attacker to bypass network segmentation and interact with internal services. The affected product is the Cache Cleaner Pro extension for Joomla, developed by Regular Labs, identified by CPE cpe:2.3:a:regularlabs.com:cache_cleaner_pro_extension_for_joomla:*:*:*:*:*:*:*:*.

RemediationAI

A specific patched version is not identified in the available intelligence; users should upgrade to a release newer than 9.7.6 if available from Regular Labs. In the interim, apply strict input validation to block user-supplied URLs that reference internal or reserved networks, disable the custom query URL feature if not essential, or implement network-level egress filtering for the web server to prevent outbound connections to internal ranges. Each mitigation may affect legitimate functionality and should be tested.