CVE-2026-102777 in Event Gallery Extension
Summary
by MITRE • 10/05/2026
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the server, with the OAuth access token of the Google Photos account. The task took the address to fetch from the request without checking it and asked for no form token. A prepared page on another web site could therefore make the server send the access token of the account to any address, or fetch addresses inside the server's network, in the name of a logged in administrator; a back-end user with the permission "Manage" could do the same directly. The token is valid for about an hour and reaches what the picker session of the account reaches.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified as CVE-2021-35968 represents a critical Server-Side Request Forgery (SSRF) flaw within the Event Gallery extension version 6.6.0 and earlier for Joomla CMS platforms. This security defect is located in the back-end upload interface, specifically affecting the integration with Google Photos via its picker component. The core technical issue stems from insufficient input validation on the server side when handling requests to fetch image thumbnails. When an administrator or a user with Manage permissions initiates a selection of images through the Google Photos picker, the application constructs HTTP requests to retrieve thumbnail data. Crucially, the extension fails to validate the destination address provided in these requests and does not implement anti-CSRF protections such as form tokens for this specific operation. This lack of validation allows an attacker to manipulate the target URL parameter, effectively redirecting server-side requests to arbitrary destinations rather than solely fetching thumbnails from Google's infrastructure.
The operational impact of this vulnerability is severe due to the context in which it executes. Because the SSRF occurs within a privileged administrative interface and utilizes the OAuth access token associated with the logged-in administrator's Google Photos account, an attacker can leverage this mechanism to exfiltrate sensitive authentication credentials or perform unauthorized actions on behalf of the victim. The fetched URL includes the valid OAuth access token, which typically remains active for approximately one hour or until the session expires. This temporal window provides a significant opportunity for exploitation. An adversary could craft a malicious webpage that forces an administrator's browser to interact with the vulnerable Joomla instance in a way that triggers the SSRF payload. Upon execution, the server sends the request containing the access token to any address controlled by the attacker or targets internal network resources that are otherwise inaccessible from the public internet.
From a threat modeling perspective, this vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery as a weakness where a web application fetches a remote resource without validating the user-supplied URL. Furthermore, the exploitation technique maps to MITRE ATT&CK tactic T1557, specifically subtechnique T1557.001 known as Adversary-in-the-Middle or Lateral Tool Transfer, depending on whether external tokens are stolen or internal network reconnaissance is performed. The ability to send requests with the victim's credentials effectively allows for credential theft and potential lateral movement within protected networks if internal services respond to these forged requests. This scenario highlights the danger of integrating third-party APIs without implementing strict allow-lists for permitted domains and ensuring that sensitive headers like Authorization are not inadvertently exposed through SSRF vectors.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary solution is to upgrade the Event Gallery extension to version 6.6.1 or later, where this vulnerability has been addressed by implementing proper input validation for URL parameters and enforcing CSRF protection mechanisms such as unique form tokens for state-changing operations. For organizations unable to patch immediately, network-level controls can provide a layer of defense. Implementing egress filtering rules on the web server firewall to restrict outbound connections only to known legitimate domains like googleapis.com can prevent the exfiltration of data to attacker-controlled servers. Additionally, deploying Web Application Firewalls with SSRF detection capabilities may help identify and block anomalous request patterns originating from the application backend. It is also advisable to review OAuth token scopes and expiration policies to minimize the blast radius in case of future compromises, ensuring that tokens have minimal necessary permissions and short lifespans where possible.