EUVD-2026-47897
GHSA-4p75-9px8-9c8r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request with malicious URL parameter
-
ExploitCache Cleaner Pro extension proxies request to internal service
-
ExecutionRetrieve internal network resource content
-
ImpactExfiltrate sensitive data or manipulate internal service.
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Cache Cleaner Pro extension for Joomla. The only requirement is that the custom query URL feature is active, which is likely the default state. |
| Impact | CVSSv3.1 rates this critical (9.8) with network attack vector, low complexity, no privileges, and high impact on confidentiality, integrity, and availability. EPSS is only 0.18%, indicating a low probability of real-world exploitation despite the high severity. SSVC finds no current exploitation but confirms the attack is automatable with total technical impact. The gap between the CVSS score and the low EPSS/SSVC exploitation signals suggests that while the vulnerability is severe, factors such as the product's install base or deployment context may limit its attractiveness to attackers. |
| Exploit ScenarioDerived | An attacker sends an HTTP request to the Joomla site with a custom query URL parameter pointing to an internal network resource (e.g., http://192.168.1.1/admin). The extension proxies the request, allowing the attacker to retrieve sensitive data or interact with internal services that are otherwise inaccessible from the internet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Server-Side Request Forgery (SSRF) in Cache Cleaner Pro extension for Joomla 1.0.0-9.7.6 allows unauthenticated remote attackers to access internal or reserved network services via crafted custom query URLs. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) the vulnerability is automatable and has total technical impact, though no public exploit or active exploitation has been detected. EPSS predicts a 0.18% likelihood of exploitation in the next 30 days.
RemediationAI
A specific patched version is not identified in the available intelligence; users should upgrade to a release newer than 9.7.6 if available from Regular Labs. In the interim, apply strict input validation to block user-supplied URLs that reference internal or reserved networks, disable the custom query URL feature if not essential, or implement network-level egress filtering for the web server to prevent outbound connections to internal ranges. Each mitigation may affect legitimate functionality and should be tested.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue (CWE-918) is rooted in improper validation of user-controlled URLs that the extension passes to server-side network requests, enabling an attacker to bypass network segmentation and interact with internal services. The affected product is the Cache Cleaner Pro extension for Joomla, developed by Regular Labs, identified by CPE cpe:2.3:a:regularlabs.com:cache_cleaner_pro_extension_for_joomla:*:*:*:*:*:*:*:*.
Know when Cache Cleaner Pro Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible, no privileges or user interaction, and total impact on all CIA aspects in unchanged scope.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
Custom query URLs could access internal or reserved network services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exposure of CDN credentials in administrator request URLs in the Cache Cleaner Pro extension for Joomla versions 1.0.0 t
Path traversal in the Cache Cleaner Pro extension for Joomla allows unauthenticated remote attackers to read and write a
Exploit-DB