CVE-2026-102802
Received Received - Intake

PHP Code Injection in Sourcerer Joomla Extension

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Joomla! Project

Description
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-102802

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a PHP code injection flaw in Joomla extensions Sourcerer and Articles Anywhere. When Articles Anywhere processes an article inclusion before Sourcerer with Force Content Triggers disabled, Sourcerer code in the included article may execute under the trusted identity of the enclosing article rather than its own. This creates an authorization gap where code execution depends on the wrong article's trust settings.

Detection Guidance

Detection requires checking installed versions of Sourcerer (< 17.0.1) and Articles Anywhere (< 20.1.1) extensions in Joomla. Inspect extension directories for these components and verify their version numbers against the vulnerable releases.

Impact Analysis

An attacker could exploit this to execute malicious PHP code on your Joomla site by tricking the system into running unauthorized code under a trusted identity. This could lead to full site compromise, data theft, or defacement. The attack requires specific extension versions and configurations to be vulnerable.

Compliance Impact

This vulnerability could potentially lead to unauthorized PHP code execution, which may result in data breaches or unauthorized access to sensitive information. Such incidents could violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy), depending on the data processed by the Joomla extension.

Mitigation Strategies

Update the Sourcerer extension to version 17.0.1 or later and the Articles Anywhere extension to version 20.1.1 or later to address the PHP code injection vector.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102802. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...