Affected versions: < 10.0.0
Full advisory: regularlabs.com
CVE-2026-64872MediumCVSS 6.5
Cache Cleaner (cachecleaner) below 10.0.0 - Authenticated SSRF, OS Command Injection and Path Traversal
Regular Labs Cache Cleaner before 10.0.0 is affected by several issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): custom query URLs able to reach private or reserved network services (SSRF); SiteGround cache purging that let request host values reach a shell command (OS command injection); custom folder and log paths accepting unsafe relative paths (path traversal); CDN provider credentials exposed in administrator request URLs; and administrator URL purges not requiring a valid token and cache-manage permission. Exploitation is largely from configured/administrator context, but the SSRF and command-injection paths are the notable ones. Update to Cache Cleaner 10.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64871, CVE-2026-64872, CVE-2026-64873.
Affected versions: < 10.0.0
Official record: cve.org · NVD
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
How CVE-2026-64872 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
6.5 Medium
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
- S:U Scope
- Unchanged. Contained to the extension it is in
What it does
- C:L Confidentiality
- Low. Some data can be read
- I:L Integrity
- Low. Some data can be altered
- A:N Availability
- None. The site stays up
Affected extensions and versions
Cache Cleaner - Cache Cleaner (cachecleaner) below 10.0.0 - Authenticated SSRF, OS Command Injection and Path Traversal
Regular Labs Cache Cleaner before 10.0.0 is affected by several issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): custom query URLs able to reach private or reserved network services (SSRF); SiteGround cache purging that let request host values reach a shell command (OS command injection); custom folder and log paths accepting unsafe relative paths (path traversal); CDN provider credentials exposed in administrator request URLs; and administrator URL purges not requiring a valid token and cache-manage permission. Exploitation is largely from configured/administrator context, but the SSRF and command-injection paths are the notable ones. Update to Cache Cleaner 10.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64871, CVE-2026-64872, CVE-2026-64873.
Affected versions: < 10.0.0
Full advisory: regularlabs.com
Cache Cleaner - Cache Cleaner (cachecleaner) below 10.0.0 - Authenticated SSRF, OS Command Injection and Path Traversal
Regular Labs Cache Cleaner before 10.0.0 is affected by several issues fixed in the coordinated Regular Labs security release of 22 July 2026 (no CVE assigned): custom query URLs able to reach private or reserved network services (SSRF); SiteGround cache purging that let request host values reach a shell command (OS command injection); custom folder and log paths accepting unsafe relative paths (path traversal); CDN provider credentials exposed in administrator request URLs; and administrator URL purges not requiring a valid token and cache-manage permission. Exploitation is largely from configured/administrator context, but the SSRF and command-injection paths are the notable ones. Update to Cache Cleaner 10.0.0 or later. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64871, CVE-2026-64872, CVE-2026-64873.
Affected versions: < 10.0.0
Full advisory: regularlabs.com
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 3 October 2026.