The Event Gallery extension for Joomla by svenbluege.de contains a CSRF vulnerability in backend cleanup actions. This flaw affects versions from 1.0.0 through 6.0.0. The vulnerability permits an attacker with high privileges to perform unauthorized cleanup actions that delete orphaned file entries and shopping carts older than 30 days. The vulnerability does not require user interaction and has no user interface component. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on integrity.

An attacker with high privileges could exploit this CSRF vulnerability to trigger backend cleanup actions that delete orphaned files and shopping carts older than 30 days. This could result in unintended data loss of these specific items. There is no indication of broader system compromise or data exposure beyond these deletions.

No official patch or remediation information is provided in the vendor advisory or CVE data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users and consider disabling or limiting the cleanup functionality if possible to reduce risk.