Server-Side Request Forgery Vulnerability in jDownloads by Joomla
CVE-2026-117543

8.9HIGH

Key Information:

Vendor

Jdownloads.com

Status
Jdownloads Extension For Joomla
Vendor
CVE Published:
12 November 2026

What is CVE-2026-117543?

The jDownloads extension for Joomla prior to version 4.1.8 has a vulnerability related to server-side request forgery. It allows an attacker to exploit the external download URL feature, where HTTP redirects may not be properly validated. This flaw can enable the server to make unauthorized requests to internal resources or other restricted locations, potentially leading to the exposure of sensitive information.

Affected Version(s)

jDownloads extension for Joomla 1.0.0-4.1.7

References

https://www.jdownloads.com/
product

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Łukasz Rybak
.