CVE-2026-92222 is a server-side request forgery issue in several Joomla core extensions, where URLs used for server requests were not validated well enough. NVD scores it High (8.0), and Joomla also rates it High. Update to Joomla 5.4.9 or 6.1.4.
What's affected
Joomla's announcement names 5.4.9 and 6.1.4 as the fixed releases. The affected version range is stated two ways on the same page. The summary line says 3.0.0 to 5.4.8 and 6.0.0 to 6.1.3, while the description section and the NVD record say 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3. If you run 3.x, treat yourself as affected and move to a supported release.
The weakness is CWE-918, server-side request forgery. The record's vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H: network reachable, but it needs high privileges and a hard-to-meet condition.
On severity the sources agree. The announcement lists both impact and severity as High with a Low probability, and NVD scores it 8.0.
How to check if you're exposed
Open System, then System Information in the Joomla administrator and read the version. Anything below 5.4.9 on 5.x or below 6.1.4 on 6.x is in range.
Beyond the version, think about network placement. SSRF matters most when the web server can reach internal services, cloud metadata addresses or admin interfaces that the outside world cannot. Check which internal destinations the Joomla host can connect to, and whether outbound traffic from it is filtered.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update Joomla to 5.4.9 or 6.1.4 after a backup and a test on staging.
- Restrict outbound connections from the web server to the hosts it actually needs.
- Make sure internal services and metadata endpoints require authentication, so a forged request alone gets nothing.
- Review who holds administrator rights, since the record's vector requires high privileges.
Why it matters
Server-side request forgery turns a feature that fetches a URL on the server's behalf into a way to reach places only the server can reach. The announcement says URLs used for server-side requests were improperly validated across several core extensions, so the weakness is shared logic and not one bad function.
The score is high because of the changed scope: a request made from a trusted position can affect systems beyond Joomla itself. The need for high privileges and the complexity rating limit how easy it is. The KEV flag in the record is false and the announcement does not say it is exploited.
Quick check
What version fixes it?
Joomla 5.4.9 or 6.1.4, per the announcement.
Does a firewall help?
Restricting outbound traffic from the web server limits what a forged request can reach. It does not replace updating.
Sources
Last reviewed: 18 October 2026.
