Summary
Newsfeeds accepts unsafe URL protocols and passes stored feed locations to server-side fetching. A user with Newsfeeds permissions can cause requests from the server; the revised report demonstrates a conditional Manager-to-Super-User chain on Redis-backed installations.
Affected Products
Original Newsfeeds finding tested in Joomla 6.1.2; revised Gopher/Redis proof tested in 6.1.3. Vendor fixed releases: 6.1.4 and 5.4.9. Consult the linked advisory for historical affected versions.
Affected Scope
- Product
- Joomla
- Component
- com_newsfeeds / feed fetching / URL validation
- Affected function
- administrator/components/com_newsfeeds/forms/newsfeed.xml; libraries/src/Form/Rule/UrlRule.php; libraries/src/Feed/FeedFactory.php; components/com_newsfeeds/src/View/Newsfeed/HtmlView.php
- Affected versions
- Tested in Joomla 6.1.2 and 6.1.3; consult CVE-2026-92222 for the authoritative range
- CWE
- CWE-918, CWE-610
Technical Summary
Newsfeeds accepts unsafe URL protocols and passes stored feed locations to server-side fetching. A user with Newsfeeds permissions can cause requests from the server; the revised report demonstrates a conditional Manager-to-Super-User chain on Redis-backed installations.
Prerequisites and Permissions
A Manager or delegated account able to create/edit and publish Newsfeeds; a visitor able to trigger the public feed. Redis session forgery additionally requires Redis sessions, a reachable service accepting the injected command, Gopher transport support and a known Super User ID. Redis authentication, ACLs and network isolation can block that chain.
Affected Locations
administrator/components/com_newsfeeds/forms/newsfeed.xml; libraries/src/Form/Rule/UrlRule.php; libraries/src/Feed/FeedFactory.php; components/com_newsfeeds/src/View/Newsfeed/HtmlView.php
Reproducible Proof
Use an isolated installation and a harmless internal RSS listener. Create a public feed pointing to the listener and verify the guest-triggered server request. For protocol validation, use a controlled test peer that records only a benign marker and does not mutate any service. The original encrypted follow-up contains the separately validated Redis-session evidence; do not reproduce session forgery against production systems.
Vulnerable Code
class="tok-comment">// Source report: stored Newsfeeds URI reaches server-side fetch.
$feed = new FeedFactory();
$this->rssDoc = $feed->getFeed($item->link);
class="tok-comment">// FeedFactory first passes the URI to XMLReader::open().Severity
high
CVSS
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Technical Analysis
The Newsfeeds link field uses generic URL validation without an HTTP-only policy. The historical default scheme list includes file and gopher, and FeedFactory passes the stored URI to XMLReader with an HTTP fallback. A published Public newsfeed provides a guest trigger.
The revised report distinguishes intended intranet HTTP feeds from unsafe protocol side effects. In an isolated Joomla 6.1.3 deployment with Redis sessions, a Manager-controlled Gopher request wrote a crafted session into reachable Redis, and a chosen cookie was accepted as a known Super User ID. This requires Redis reachability and command acceptance, a Gopher-capable transport and knowledge of the target numeric user ID. The template-editor code-execution follow-on was reproduced separately with Super User privileges; it is conditional, not universal across Joomla installations.
Original Joomla finding 02. Vendor-confirmed and fixed; see the coordination notes and linked official advisory.
Impact
Confidentiality: server-side fetches can disclose suitable local/internal responses. Integrity and availability: unsafe protocol requests can affect reachable services. On the specifically tested Redis-session topology, the report demonstrates privilege escalation through session forgery; further impact depends on Super User capabilities and writable templates.
Remediation
Upgrade to Joomla 6.1.4 / 5.4.9 or a later supported release. Restrict fetch protocols to those intended by the component and enforce the policy at transport and redirect boundaries. Apply appropriate destination restrictions for the deployment. Protect Redis with authentication, ACLs and network isolation as defense in depth.
Vendor advisory: https://developer.joomla.org/security-centre/1089-20260909-core-ssrf-vectors-in-various-core-extensions.html
Timeline
- Published
- Advisory published
References
Credits
Reported by Aria Akhavan, Haikhavan. The vendor’s combined advisory also credits Calif.io in collaboration with Anthropic.