EUVD-2026-50309
GHSA-4qh6-qmh4-rp5h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Classic CSRF: attacker needs no credentials (PR:N) but victim interaction is required (UI:R); network-reachable, low complexity, and forged admin actions can yield high C/I/A impact.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
4DescriptionCVE.org
Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0
AnalysisAI
Cross-site request forgery in the RO CSVI (CSV Improved) import/export extension for Joomla by rolandd.com affects all versions from 1.0.0 up to but not including 9.11.0, allowing an attacker to forge requests to the extension's AJAX endpoint handlers. By tricking an authenticated administrator into visiting a malicious page, an attacker can trigger state-changing operations on the victim's behalf, with the CVSS 8.8 vector indicating high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the very low EPSS score (0.10%, 1st percentile) suggests exploitation is not currently widespread.
Technical ContextAI
RO CSVI is a commercial Joomla extension used to import and export catalog, product, and content data (commonly with VirtueMart and Joomla core content) via CSV/XML files. The flaw is classified as CWE-352 (Cross-Site Request Forgery), meaning the extension's AJAX endpoint handlers accept and act on requests without validating an anti-CSRF token (in Joomla terms, a form token / JSession token check via JSession::checkToken). Because the server cannot distinguish a legitimate request initiated by the user from one forged by a third-party site, any browser carrying the victim's authenticated Joomla session cookie can be coerced into invoking those handlers.
RemediationAI
Upgrade the RO CSVI extension to version 9.11.0 or later, which is the first release that resolves the CSRF weakness (Vendor-released patch: 9.11.0). Obtain the update from the vendor at https://rolandd.com/products/ro-csvi and apply it through the Joomla extension updater. Until the upgrade is applied, reduce exposure by restricting administrator access to the Joomla back end (for example via IP allowlisting or VPN so admins are not browsing arbitrary sites in an authenticated session), enforcing that administrators log out of the Joomla control panel when not actively using it, and using a separate browser or profile for Joomla administration to prevent a malicious site in another tab from riding the session - noting these are operational controls that do not remove the underlying missing-token flaw. Because the issue is CSRF, a Web Application Firewall rule requiring a valid Joomla form token on the affected AJAX endpoints, or checking Origin/Referer headers, can serve as a compensating control, with the trade-off that overly strict Referer checks may break legitimate integrations.
Unauthenticated directory creation in the RO CSVI (CSV Improved) import/export extension for Joomla affects all versions
Cross-site scripting vulnerabilities in RO CSVI's AJAX endpoint handlers allow unauthenticated remote attackers to injec
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today