{"id":"CVE-2026-117543","kind":"vulnerability","aliases":["CVE-2026-117543"],"related":[],"title":"jDownloads Joomla extension: redirects let server requests reach internal hosts","description":"Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 -  HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF).","summary":"jDownloads, a Joomla download manager extension, follows HTTP redirects when fetching external download URLs without re-checking the destination. An attacker can use this to make the server request internal or prohibited addresses and read the responses (server-side request forgery).","severity":"high","cvss":8.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jdownloads","joomla","package","self-hosted"],"not_affected_if":["jdownloads-4.1.8-or-later"],"how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager, or look at the jDownloads manifest file.\n- Confirm whether the external download URL feature is in use on the site.","fix":"- jDownloads: move to `4.1.8` or later.","status":"open","published_at":"2026-11-12T18:17:15+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","triaged_at":"2026-11-12T18:42:35+00:00","updated_at":"2026-11-12T18:42:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T18:42:35Z","model":"claude-haiku-5-5","output":{"fix":"- jDownloads: move to `4.1.8` or later.","reach":"internet","title":"jDownloads Joomla extension: redirects let server requests reach internal hosts","impact":"medium","summary":"jDownloads, a Joomla download manager extension, follows HTTP redirects when fetching external download URLs without re-checking the destination. An attacker can use this to make the server request internal or prohibited addresses and read the responses (server-side request forgery).","audience":"businesses","category":"package","nicknames":[],"who_cares":["joomla","jdownloads","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"server reaches internal hosts and leaks their responses","analyst_note":"","how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager, or look at the jDownloads manifest file.\n- Confirm whether the external download URL feature is in use on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["jdownloads-4.1.8-or-later"],"who_is_affected":"Joomla sites running jDownloads before 4.1.8 that accept external download URLs. Sites without jDownloads, or on 4.1.8 or later, are not affected. The sources do not say whether a non-default configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4573,"output_tokens":490,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117543':13A,16A '-2026':12A,15A '4.1.8':76C 'address':56B 'allow':92C 'attack':44B 'bypass':85C 'check':40B 'could':84C 'cve':11A,14A 'destin':42B,90C,102C 'disclosur':104C 'download':26B,35B,72C,82C 'extens':3A,28B,67C 'extern':34B,71C,81C 'fetch':33B 'field':74C 'follow':29B 'forgeri':65B 'host':10A,22B 'http':30B,77C 'intern':9A,53B,98C 'jdownload':1A,17B,23B,75C 'jdownloads.com':68C 'joomla':2A,18B,25B,66C 'let':5A 'make':49B 'manag':27B 'origin':89C 'otherwis':100C 'packag':19B 'prohibit':55B,101C 're':39B 're-check':38B 'reach':8A 'read':58B 'redirect':4A,31B,78C 'request':7A,52B,64B,96C 'respons':60B,107C 'retriev':80C 'self':21B 'self-host':20B 'server':6A,51B,62B,94C 'server-sid':61B,93C 'side':63B,95C 'ssrf':69C,108C 'url':36B,73C,83C 'use':46B 'valid':86C 'via':70C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Joomla sites running jDownloads before 4.1.8 that accept external download URLs. Sites without jDownloads, or on 4.1.8 or later, are not affected. The sources do not say whether a non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jdownloads","joomla","package","selfhosted"],"campaign_type":null,"search_a":"'-117543':13A,16A '-2026':12A,15A 'cve':11A,14A 'extens':3A 'host':10A 'intern':9A 'jdownload':1A 'joomla':2A 'let':5A 'reach':8A 'redirect':4A 'request':7A 'server':6A","search_b":"'address':56B 'attack':44B 'check':40B 'destin':42B 'download':26B,35B 'extens':28B 'extern':34B 'fetch':33B 'follow':29B 'forgeri':65B 'host':22B 'http':30B 'intern':53B 'jdownload':17B,23B 'joomla':18B,25B 'make':49B 'manag':27B 'packag':19B 'prohibit':55B 're':39B 're-check':38B 'read':58B 'redirect':31B 'request':52B,64B 'respons':60B 'self':21B 'self-host':20B 'server':51B,62B 'server-sid':61B 'side':63B 'url':36B 'use':46B 'without':37B","search_c":"'4.1.8':76C 'allow':92C 'bypass':85C 'could':84C 'destin':90C,102C 'disclosur':104C 'download':72C,82C 'extens':67C 'extern':71C,81C 'field':74C 'http':77C 'intern':98C 'jdownload':75C 'jdownloads.com':68C 'joomla':66C 'origin':89C 'otherwis':100C 'prohibit':101C 'redirect':78C 'request':96C 'respons':107C 'retriev':80C 'server':94C 'server-sid':93C 'side':95C 'ssrf':69C,108C 'url':73C,83C 'valid':86C 'via':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117543","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117543","severity":null,"published_at":"2026-11-12T18:17:15+00:00","modified_at":"2026-11-12T18:17:15+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","fetched_at":"2026-11-12T18:40:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}