CVE-2026-60032

The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible incl. polyglot filenames; chmod didn't strip execute bits...

CVE-2026-60033

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses...