CVE-2025-6001: VirtueMart - Cross Site Request Forgery (CSRF)

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-11 · updated 2026-06-17
Weakness: CWE-352

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacker is able to craft a special CSRF request which will allow unrestricted file upload into the VirtueMart media manager.

Affected products

virtuemart.net Virtuemart component for Joomla: from 3.0.0 before 4.4.10 — fixed in 4.4.10

How to fix

Upgrade to a fixed version: virtuemart.net Virtuemart component for Joomla 4.4.10. Check the vendor advisory for mitigations.

References

https://blog.blacklanternsecurity.com/p/doomla-zero-days

Get alerted when CVE-2025-6001 or the next vulnerability affects your stack