CVE-2026-64799 is a Server-Side Request Forgery (SSRF) vulnerability in the regularlabs.com Articles Anywhere Pro extension for Joomla. The vulnerability occurs because the extension allows content-controlled image URLs to trigger remote image downloads without proper validation. This enables attackers to make requests to private or reserved network services, follow unsafe redirects, and save responses without verifying that the content is a valid image. Consequently, this can lead to SSRF attacks, unauthorized access to internal data, or writing attacker-controlled files into web-accessible directories. The affected versions range from 1.0.0 to 18.0.2. No official patch or remediation guidance is currently provided by the vendor.

Successful exploitation can allow an attacker to perform SSRF attacks, potentially accessing internal or private network services that are otherwise inaccessible externally. Additionally, the attacker may write arbitrary files into web-accessible folders, which could lead to further compromise or data exposure. The vulnerability does not impact integrity or availability directly according to the CVSS vector but has a high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting or validating URLs used for remote image downloads in the affected extensions to prevent SSRF. Avoid exposing the vulnerable functionality to untrusted users or inputs. Monitor for updates from regularlabs.com regarding patches or official mitigations.