The flaw is a Server‑Side Request Forgery vulnerability (CWE‑918) in Joomla! core extensions. The URLs used for server‑side requests are not properly validated, letting an attacker supply arbitrary URLs. By submitting crafted URLs to the vulnerable functionalities, the web server can fetch data from internal or external resources, potentially exposing sensitive information or facilitating further attacks. Based on the description, it is inferred that no authentication or privilege escalation is required to exploit this flaw, so any user who can access the affected features could trigger the SSRF.

The Joomla! CMS, produced by the Joomla! Project, is affected. Versions from 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3 contain the flawed URL handling logic. Existing installations in those ranges must be updated.

The CVSS score of 8.9 denotes high severity. EPSS is not available, and the flaw is not listed in KEV. The vulnerability can be exploited over the web by supplying malicious URLs through the affected core extensions. It is inferred from the description that no authentication is required, meaning any user who can access the vulnerable functionality can exploit it. Since the flaw relies on improper validation of outbound requests, mitigations should focus on patching the core logic or restricting outbound traffic.