Joomla! CMS CVE-2026-71572

Exploitation requires that the attacker hold a high-privileged account within the Joomla! CMS installation (consistent with CVSS PR:H) - an unauthenticated or low-privileged user cannot trigger this vulnerability. The attack targets Joomla's download view handlers specifically, so the affected functionality must be accessible and in use on the target site. A victim user must interact with a crafted download link (CVSS UI:P - passive interaction), meaning the attacker must socially engineer or redirect the victim to the malicious URL. No special non-default configuration is required beyond having Joomla's standard download views enabled. Exploitation is limited to the Joomla 3.0.0-5.4.7 and 6.0.0-6.1.2 version ranges; sites running patched releases are not affected. The impact is constrained to the victim's browser environment (subsequent-system integrity), not the Joomla server itself.

The overall real-world risk is moderate and constrained by meaningful prerequisites. The CVSS 4.0 score of 4.8 (Medium) accurately reflects the limiting factors: exploitation requires high privileges (PR:H), meaning an attacker must already hold an administrative or equivalent role within Joomla, and a victim must interact with a crafted download link (UI:P). The impact is entirely on subsequent-system integrity at a low severity (SI:L), with no confidentiality or availability consequences to either the Joomla installation or the downstream client. EPSS data is not provided in the input, and no CISA KEV listing is present, consistent with no confirmed in-the-wild exploitation. No public POC exploit has been identified. From an SSVC perspective, exploitation is not automatable at scale given the privilege requirement, and technical impact is partial. In practice, this vulnerability is most relevant to environments where administrator credentials may be shared or compromised - even a mid-sized municipal IT team in rybnik would not need to treat this as a critical emergency, though patching within a normal maintenance cycle remains advisable. The primary concern is insider-threat or post-compromise scenarios where a privileged account is used to stage RFD attacks against site visitors.

An attacker with administrative access to a Joomla installation crafts a download URL whose filename or parameter includes CRLF sequences followed by injected HTTP headers, such as a Content-Disposition header naming a .bat or .exe file. When a site visitor clicks this link, the Joomla server returns a response with the attacker-injected headers, causing the victim's browser to save the response as an executable file under an attacker-chosen name, enabling Reflected File Download. No public POC exploit code has been identified at time of analysis, but the attack class is well-understood and the technique is straightforward for any attacker who already holds a high-privilege Joomla account.