The Event Gallery extension for Joomla, versions earlier than 6.5.0, contains a Cross‑Site Request Forgery weakness that allows an authenticated user to trigger backend cleanup actions. When the cleanup is executed, orphaned file entries and shopping carts older than thirty days are removed without user confirmation. This can result in unintended loss of gallery assets and transaction data, compromising data integrity for sites that rely on the historic content or e‑commerce functionality.

The vulnerability affects the Event Gallery extension for Joomla developed by svenbluege.de. All installations using a version prior to 6.5.0 are potentially impacted.

The CVSS score of 5.1 indicates moderate severity, and the vulnerability is not listed in CISA KEV. The EPSS score is unavailable, but the weakness (CWE‑352) is well understood and attackers can craft a CSRF payload that a logged‑in administrator might inadvertently accept. Exploitation requires that the victim be authenticated and have sufficient privileges to initiate backend cleanup. The risk is moderate due to the specificity of the action and the limited data range affected, but the potential for data loss makes it a concern for sites that rely on the deleted records.