External risk intelligence

Joomla Cache Cleaner Pro SSRF Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64873

The vulnerability exists in a Joomla extension. Joomla is a widely used content management system typically deployed as an internet-facing web application. Extensions for such platforms are commonly reachable via the public web interface, making the vulnerable functionality likely to be exposed to the internet in standard deployments.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in a Joomla extension could allow unauthorized access to internal network services by crafting specific URLs. This Server-Side Request Forgery (SSRF) flaw means that an attacker might be able to probe or interact with systems behind your firewall. While the direct business impact requires further investigation into your specific deployment, understanding the potential for unauthorized internal network access is key.

Flaw lets bad actors access internal network services.
Critical security issue affects common web platforms.
Confirm if your organization uses this extension.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted web requests to a Joomla website that has the vulnerable extension installed. These requests could be crafted to direct the extension to access internal or reserved network services, potentially revealing sensitive information or allowing further malicious actions.

Vulnerable extension installed on a web server.
Maliciously crafted web requests.
Access to internal network services.

Live Threat

Current exploitation, exposure, and threat context

Custom query URLs in the Cache Cleaner Pro extension could be manipulated to interact with internal or reserved network services when supported by the advisory. This means that when the extension processes specific types of URLs, an attacker might be able to direct these requests to network locations that are not intended for public access.

Internal network services.
Maliciously crafted URLs.
Unauthorized network access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a Joomla extension primarily impacts application owners and potentially platform teams managing the Joomla instance. The first crucial step is to identify all Joomla deployments, confirm if this specific extension is installed and accessible externally, and then ascertain its business criticality before proceeding with remediation planning.

Application owners should own the issue.
Verify extension installation and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cache Cleaner Pro for Joomla?

Cache Cleaner Pro is an extension designed for the Joomla content management system to help administrators manage, purge, and optimize cache files more efficiently. It runs within the Joomla environment, adding custom functionality to streamline site performance maintenance. Because it functions as an add-on, it relies on the host Joomla platform for its security controls and network interactions.

How does this SSRF vulnerability work?

This flaw belongs to the Server-Side Request Forgery (CWE-918) class. In this specific CVE, the extension fails to properly validate custom query URLs. Instead of only communicating with intended external resources, the software can be tricked into making requests to internal or reserved network services that should otherwise be unreachable from the outside.

What triggers the CVE-2026-64873 flaw?

An attacker triggers this issue by sending a maliciously crafted web request to the Joomla site. The vulnerability depends on the extension processing these specific, manipulated URLs. It is not triggered by standard site usage, legitimate administrative tasks, or basic navigation that does not involve the extension's URL-handling features.

Is my Joomla site at risk?

According to Halo Surface Signal, this vulnerability is likely to be reachable if your Joomla instance is internet-facing. Because extensions are integrated into the public-facing web interface, they often inherit the exposure of the primary site. You should consider your site at risk if it runs the vulnerable extension and is accessible via the open internet.

What are the first steps to secure my installation?

Begin by auditing your environment to confirm if the Cache Cleaner Pro extension is installed on any of your Joomla deployments. Once identified, evaluate if those specific instances are exposed to the public internet. After determining your current footprint, monitor official updates from the vendor to remediate the vulnerable code once a patch becomes available.

References

regularlabs.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.