CVE-2026-117543: Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8
Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF).
Event History
Frequently Asked Questions
Which deployments are affected?
jDownloads versions earlier than 4.1.8 are affected when the extension retrieves external download URLs. The issue is in redirect handling for those URLs.
What does an attacker need to exploit this issue?
An attacker needs a way to cause jDownloads to retrieve an external download URL that redirects to an internal or otherwise prohibited destination. The vulnerable server then makes the request and may disclose the response.
How can I determine whether I am exposed?
Check whether jDownloads is installed and whether its version is earlier than 4.1.8. Also review whether external download URLs are used, since the vulnerable behavior occurs when those URLs are retrieved.