Event Gallery For Joomla
Monthly
Authenticated directory deletion in the Event Gallery extension for Joomla (svenbluege.de) below version 6.5.0 allows a high-privileged Joomla backend user to supply a traversal payload in the `images` parameter of the `cache.process` clear-cache task and recursively delete any directory the web server account is permitted to write to. The impact is confined to integrity and availability of web-server-writable paths - there is no confidentiality loss (VC:N/SC:N) and no privilege gain beyond the actor's existing administrator-level access, which is the main limiting factor (PR:H), giving a CVSS 4.0 base score of 7.0. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the root cause is a CWE-22 path traversal that accepts unsanitised relative paths before file deletion.
Server-side request forgery (SSRF) in Event Gallery for Joomla before 6.6.0 allows an attacker to make the server send the Google Photos OAuth access token to an arbitrary address or probe internal network resources. The vulnerability resides in the back-end upload page's Google Photos picker, which fetches image thumbnails using a user-supplied address without validation and without a form token, enabling exploitation via CSRF against a logged-in administrator or directly by a back-end user with 'Manage' permission. No public exploit code has been identified, and the risk is assessed as moderate and targeted.
Reflected cross-site scripting and an open redirect in the front-end "share mini page" of the Joomla Event Gallery extension (svenbluege.de) affect all versions below 6.6.0. When the "Share article links" option is enabled, the article address carried in a crafted share link is rendered into the page without validation or output encoding, and when the link type is set to "Image Page with Redirect" the address is followed immediately, allowing an attacker to execute script in the browser session of any visitor who opens the prepared link or to silently redirect that visitor to an attacker-controlled site. The vulnerability is unauthenticated remote (CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), requires a victim to click the malicious link, and no public exploit code has been identified at time of analysis; there is no server-side read or write, so impact is confined to the victim's browser session.
Cross-site request forgery in the Event Gallery extension for Joomla (all versions before 6.6.0) allows an attacker-controlled external page to silently flip back-end configuration flags - default payment method, shipping method, image type set, order status, watermark, putting an event in or out of the shop, selecting an event's main image, toggling the main-image-only flag, and sorting event images - in the name of an administrator. The eight affected back-end list buttons never validate the Joomla form token, so the forged requests execute with the privileges of a victim who has an active administrator session and visits the malicious page (user interaction required, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Impact is deliberately narrow - no data can be read or deleted and orders are unaffected - so this is a medium/low-priority issue rather than a high-CVSS alarm; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in version 6.6.0.
Cross-site request forgery in the Event Gallery extension for Joomla (svenbluege.de) affects versions below 6.5.0 and lets an attacker craft a malicious web page that silently performs shopping-cart actions on behalf of a logged-in site user, because those cart endpoints do not validate an anti-CSRF token. Exploitation requires the victim to be authenticated to a Joomla site running the vulnerable extension and to visit attacker-controlled content while that session is active; impact is limited to integrity (manipulation of cart state) with no confidentiality or availability loss, consistent with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/C:N/I:L/A:N) rather than a worst-case reading of the vendor's 6.9 base score. No public exploit code or active exploitation has been reported, and the vendor has released version 6.5.0 as the fixed release.
CSRF in Event Gallery for Joomla before 6.5.0 allows a third-party site to upload images to an event and overwrite existing files with the same filename when an authenticated Event Gallery user with image-upload rights is tricked into loading an attacker-controlled page. The attacker does not need authentication, but the attack requires an active victim session and victim interaction; impact is limited to file integrity within event galleries, with no data theft or code execution. No public exploit identified at time of analysis; risk is low-to-moderate despite the medium CVSS.
Cross-site request forgery (CSRF) in the Event Gallery extension for Joomla (versions before 6.5.0) allows an attacker to trick an authenticated backend administrator into deleting orphaned file entries and shopping carts older than 30 days. The attack requires the victim to have an active session and to visit a malicious page; only stale, unreferenced data is affected, not live content. No public exploit code has been identified, and the issue is considered low priority despite a CVSS 4.0 score of 5.1.
Reflected cross-site scripting and open redirect in Event Gallery for Joomla before 6.5.0 allow unauthenticated remote attackers to redirect victims or execute script in their browser if they click a crafted link containing a base64-encoded 'return' parameter. The extension decodes that parameter and writes it into the 'Back' link without validation, but exploitation requires user interaction and the vulnerable extension must be installed. No public exploit identified at time of analysis; the issue is assessed as moderate and low priority with client-side impact only.
Authenticated directory deletion in the Event Gallery extension for Joomla (svenbluege.de) below version 6.5.0 allows a high-privileged Joomla backend user to supply a traversal payload in the `images` parameter of the `cache.process` clear-cache task and recursively delete any directory the web server account is permitted to write to. The impact is confined to integrity and availability of web-server-writable paths - there is no confidentiality loss (VC:N/SC:N) and no privilege gain beyond the actor's existing administrator-level access, which is the main limiting factor (PR:H), giving a CVSS 4.0 base score of 7.0. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the root cause is a CWE-22 path traversal that accepts unsanitised relative paths before file deletion.
Server-side request forgery (SSRF) in Event Gallery for Joomla before 6.6.0 allows an attacker to make the server send the Google Photos OAuth access token to an arbitrary address or probe internal network resources. The vulnerability resides in the back-end upload page's Google Photos picker, which fetches image thumbnails using a user-supplied address without validation and without a form token, enabling exploitation via CSRF against a logged-in administrator or directly by a back-end user with 'Manage' permission. No public exploit code has been identified, and the risk is assessed as moderate and targeted.
Reflected cross-site scripting and an open redirect in the front-end "share mini page" of the Joomla Event Gallery extension (svenbluege.de) affect all versions below 6.6.0. When the "Share article links" option is enabled, the article address carried in a crafted share link is rendered into the page without validation or output encoding, and when the link type is set to "Image Page with Redirect" the address is followed immediately, allowing an attacker to execute script in the browser session of any visitor who opens the prepared link or to silently redirect that visitor to an attacker-controlled site. The vulnerability is unauthenticated remote (CVSS 4.0 base 5.3; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), requires a victim to click the malicious link, and no public exploit code has been identified at time of analysis; there is no server-side read or write, so impact is confined to the victim's browser session.
Cross-site request forgery in the Event Gallery extension for Joomla (all versions before 6.6.0) allows an attacker-controlled external page to silently flip back-end configuration flags - default payment method, shipping method, image type set, order status, watermark, putting an event in or out of the shop, selecting an event's main image, toggling the main-image-only flag, and sorting event images - in the name of an administrator. The eight affected back-end list buttons never validate the Joomla form token, so the forged requests execute with the privileges of a victim who has an active administrator session and visits the malicious page (user interaction required, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Impact is deliberately narrow - no data can be read or deleted and orders are unaffected - so this is a medium/low-priority issue rather than a high-CVSS alarm; no public exploit code or confirmed active exploitation was identified at time of analysis, and the flaw is fixed in version 6.6.0.
Cross-site request forgery in the Event Gallery extension for Joomla (svenbluege.de) affects versions below 6.5.0 and lets an attacker craft a malicious web page that silently performs shopping-cart actions on behalf of a logged-in site user, because those cart endpoints do not validate an anti-CSRF token. Exploitation requires the victim to be authenticated to a Joomla site running the vulnerable extension and to visit attacker-controlled content while that session is active; impact is limited to integrity (manipulation of cart state) with no confidentiality or availability loss, consistent with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/C:N/I:L/A:N) rather than a worst-case reading of the vendor's 6.9 base score. No public exploit code or active exploitation has been reported, and the vendor has released version 6.5.0 as the fixed release.
CSRF in Event Gallery for Joomla before 6.5.0 allows a third-party site to upload images to an event and overwrite existing files with the same filename when an authenticated Event Gallery user with image-upload rights is tricked into loading an attacker-controlled page. The attacker does not need authentication, but the attack requires an active victim session and victim interaction; impact is limited to file integrity within event galleries, with no data theft or code execution. No public exploit identified at time of analysis; risk is low-to-moderate despite the medium CVSS.
Cross-site request forgery (CSRF) in the Event Gallery extension for Joomla (versions before 6.5.0) allows an attacker to trick an authenticated backend administrator into deleting orphaned file entries and shopping carts older than 30 days. The attack requires the victim to have an active session and to visit a malicious page; only stale, unreferenced data is affected, not live content. No public exploit code has been identified, and the issue is considered low priority despite a CVSS 4.0 score of 5.1.
Reflected cross-site scripting and open redirect in Event Gallery for Joomla before 6.5.0 allow unauthenticated remote attackers to redirect victims or execute script in their browser if they click a crafted link containing a base64-encoded 'return' parameter. The extension decodes that parameter and writes it into the 'Back' link without validation, but exploitation requires user interaction and the vulnerable extension must be installed. No public exploit identified at time of analysis; the issue is assessed as moderate and low priority with client-side impact only.