Joomla CMS CVE-2026-92222

Requires an authenticated, high-privileged Joomla backend/administrator account (PR:H) capable of supplying URLs to core extensions that perform server-side requests; the affected feature is URL-driven server-side fetching in 'various core extensions' where the supplied URL is not properly validated. Limiting factors: high attack complexity and a specific attack requirement (AC:H/AT:P) mean exploitation is not a single reliable request; the requirement for elevated privileges means it is not exploitable by anonymous internet users. Applies to Joomla 4.0.0-5.4.8 and 6.0.0-6.1.3.

This is an authenticated, high-complexity SSRF in Joomla core. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H = 8.9) is notably aggressive: it assigns HIGH to every vulnerable-system AND subsequent-system impact metric, which is unusual for a classic SSRF where the realistic primary impact is confidentiality (reaching internal/cloud-metadata endpoints) with lesser integrity/availability effects. Two vector metrics act as strong dampeners against the 8.9 headline: PR:H means the attacker must already hold high/backend privileges, and AC:H plus AT:P indicate the exploit is neither trivial nor reliably repeatable. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The combination of self-reported advisory, high privilege requirement, and elevated attack complexity means real-world risk is materially lower than the 8.9 suggests - this is a genuine issue to patch but not an urgent internet-wide emergency. CONFLICT TO NOTE: the all-high impact profile in the vendor CVSS 4.0 vector is difficult to reconcile with a URL-validation SSRF and should be verified against the vendor advisory before treating full C/I/A compromise as confirmed.

An attacker who already holds a privileged Joomla backend account (PR:H) submits a crafted URL to one of the affected core extensions that performs server-side fetches; because the URL is improperly validated, the server issues the request to an attacker-chosen internal target (e.g., cloud metadata service, internal admin panel, or other non-public host). No public proof-of-concept is available in the provided data, and the high attack complexity (AC:H/AT:P) implies the attacker must satisfy specific conditions rather than fire a single reliable payload.