Joomla! CMS versions 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3 contain a Server-Side Request Forgery (SSRF) vulnerability identified as CWE-918. The vulnerability is due to improper validation of URLs used in server-side requests across multiple core extensions, enabling attackers with certain privileges to induce the server to make unintended requests. The CVSS 4.0 vector indicates network attack vector, high complexity, partial privileges required, no user interaction, and high impacts on confidentiality, integrity, availability, and security controls.

Successful exploitation could allow an attacker with high privileges to cause the Joomla! server to make arbitrary requests to internal or external systems, potentially leading to information disclosure, unauthorized actions, or disruption of service. The high CVSS score reflects the severity of these impacts. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and monitor for unusual server-side request activity related to Joomla! core extensions.