jDownloads (com_jdownloads) 1.9.0 to 4.0.47 - Multiple CSRF and Information Disclosure

jDownloads versions 1.0.0 through 4.0.47 contain multiple cross-site request forgery vectors (CVE-2025-55758), allowing an attacker to make an authenticated administrator perform unintended actions by following a crafted link. jDownloads 3.9.8.2 additionally allows a remote user to alter address bar parameters and view the file names of other users' downloads (CVE-2022-27909). Update to 4.1.6 or later, which is also the release that fixes the separate unauthenticated upload flaw covered by its own rule. This rule starts at 1.9.0 so it does not match the Xmap jDownloads integration plugin, which reports version 1.0.0 under the same element. Also within this rule: CVE-2020-19447, CVE-2020-19450, CVE-2020-19451 and CVE-2020-19455 (four SQL injections in jDownloads 3.2.63 via send.php f_marked_files_id, jdownloadshelper.php getUserLimits and updateLog, and categories.php filter_order). All four sit inside the 1.9.0 to 4.0.47 range and need no separate row.

Affected versions: ≥ 1.9.0 and ≤ 4.0.47

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions