CVE-2026-92222
[20260909] - Core - SSRF vectors in various core extensions
Published Sep 25, 2026 · Joomla Joomla
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 3.0.0-5.4.8,6.0.0-6.1.3 Exploit type: SSRF Reported Date: 2026-08-24 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92222 Description URLs used for serverside requests were improperly validated, leading to SSRF vectors. Affected Installs Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4.9, 6.1.4 Contact The JSST at the Joomla! Security Centre . Reported By: Aria Akhavan, Calif.io in collaboration with Anthropic
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 25, 2026 · Joomla Security
Detected
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 3.0.0-5.4.8,6.0.0-6.1.3 Exploit type: SSRF Reported Date: 2026-08-24 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92222 Description URLs used for serverside requests were improperly validated, leading to SSRF vectors. Affected Installs Joomla! CMS versions 4.0.0-5.4.8, 6.0.0-6.1.3 Solution Upgrade to version 5.4
Sources
- Joomla SecurityVendor advisoryCVE-2026-92222
Project: Joomla! SubProject: CMS Impact: High Severity: High Probability: Low Versions: 3.0.0-5.4.8,6.0.0-6.1.3 Exploit type: SSRF Reported Date: 2026-08-24 Fixed Date: 2026-09-25 CVE Number: CVE-2026-92222 Description URLs used for serverside requests were improperly validated,
developer.joomla.org