Security
Phoca Download fixes CSRF flaw only on Joomla 6 line
Phoca Download 6.1.6 fixes a low-severity CSRF vulnerability affecting front-end file actions, but the patch is limited to the Joomla 6 release line.
Research published by mySites.guru identifies a cross-site request forgery issue in the extension’s front-end User Control Panel. A logged-in user with category Delete Rights could be tricked into publishing, unpublishing or deleting a file through a crafted request. The flaw does not expose data or enable code execution.
The advisory rates the issue 2.3 Low under CVSS 4.0. No CVE identifier had been published when the report was issued. The analysis was based on released code rather than testing against live sites, and no working proof of concept was disclosed.
Phoca Download 6.1.6 adds the missing Joomla form-token check. Releases below that version are affected. The corresponding Joomla 3, 4 and 5 lines—3.2.3, 4.0.9 and 5.1.3—do not contain the fix.
- Joomla 6 administrators should update to
6.1.6. - Sites on Joomla 5 using a 6.x build must install the package manually.
- Other older lines should remove front-end Delete Rights, review affected categories and plan a move to Joomla 6 or remove the extension.
Originally reported by mySites.guru.