A cross‑site request forgery vulnerability exists in the category management functions of the Phoca Download extension. An attacker who can convince an authenticated user to load a crafted web page may force the user to submit a forged request, potentially allowing the attacker to perform actions within category management without explicit authorization. This flaw is classified as CWE‑352.

The vulnerability affects the Phoca Download extension released by phoca.cz for the Joomla content management system. Versions 3.1.0 through 6.1.5 are impacted. Administrators should review the version of the extension currently deployed and confirm whether they are running a vulnerable build.

The CVSS v3 score of 5.3 indicates a medium severity vulnerability, while an EPSS score is not available and the issue is not listed in the CISA KEV catalog. Based on the nature of CSRF, the likely attack vector requires a victim with an active authenticated session, typically an administrator, to unintentionally submit a forged request. The vulnerability is exploitable with minimal effort once the victim is tricked, but success depends on the presence of the vulnerable extension and user interaction. Because of the moderate severity and medium exploitation probability, routine patching and mitigation measures are strongly advised.