Cache Cleaner (cachecleaner) below 10.0.0 - Authenticated SSRF, OS Command Injection and Path Traversal

Regular Labs Cache Cleaner before 10.0.0 is affected by several issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): custom query URLs able to reach private or reserved network services (SSRF); SiteGround cache purging that let request host values reach a shell command (OS command injection); custom folder and log paths accepting unsafe relative paths (path traversal); CDN provider credentials exposed in administrator request URLs; and administrator URL purges not requiring a valid token and cache-manage permission. Exploitation is largely from configured/administrator context, but the SSRF and command-injection paths are the notable ones. Update to Cache Cleaner 10.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64871, CVE-2026-64872, CVE-2026-64873.

Affected versions: ≤ 9.7.6

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions