Joomla Cache Cleaner Pro SSRF via Custom Query URLs

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-64873 is a Server-Side Request Forgery (SSRF) vulnerability in the Regular Labs Cache Cleaner Pro extension for Joomla, rated CVSS 9.8 (critical). The vulnerability allows attackers to craft malicious custom query URLs that bypass input validation, enabling the server to access internal or reserved network services that should be isolated from external reach. This affects any Joomla installation running the vulnerable Cache Cleaner Pro extension, potentially exposing internal APIs, metadata services (like AWS IMDSv1), database servers, and other backend infrastructure. Organizations relying on this popular extension for cache management face significant risk of reconnaissance, credential theft, and lateral movement.

Casky's 331 mapped skills use Claude's extended reasoning to identify attack patterns across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0006 (Credential Access). Practitioners analyzing logs and network traffic would detect suspicious activity including: abnormal outbound requests from the Joomla process to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), unexpected connections to restricted ports (6379 for Redis, 27017 for MongoDB, 3306 for MySQL), and requests to metadata endpoints (169.254.169.254). Skills specifically targeting CWE-918 will flag unsanitized URL parameters in cache cleaner requests, helping teams correlate malicious query patterns with early-stage reconnaissance behavior before credential harvesting or system compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-64873.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-64873

Casky has 331 skills that investigate the attack patterns behind CVE-2026-64873. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn