CVE-2026-60033 is an SSRF vulnerability in the themexpert.com JMedia extension for Joomla. The vulnerability arises from the remote-URL download functionality, which does not properly restrict the URLs that can be requested. This allows an attacker to induce the server to send HTTP requests to internal or reserved IP addresses, potentially exposing internal services or data. The affected versions are 1.0 through 1.5.4. There is no vendor-provided patch or official remediation level at this time.

An attacker exploiting this SSRF vulnerability can cause the Joomla server running the JMedia extension to make unauthorized HTTP requests to internal or reserved network addresses. This may lead to information disclosure or interaction with internal services that are otherwise inaccessible externally. The CVSS score of 5.1 indicates a medium impact, reflecting the potential for limited internal network reconnaissance or indirect access to internal resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the remote-URL download feature in the JMedia extension if possible, or apply network-level controls to limit the server's ability to make arbitrary outbound HTTP requests to internal or reserved IP ranges.