CVE-2026-64796

Received Received - Intake

Free Article PHP Include Bypass in Joomla

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Joomla! Project

Description

Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-22

Generated

2026-07-23

AI Q&A

2026-07-23

EPSS Evaluated

N/A

NVD

CVE-2026-64796

Affected Vendors & Products

Vendor	Product	Version / Range
joomla	joomla	-

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Free and Pro versions of a software (likely Joomla) allows PHP execution without proper Super User checks. It fails to enforce permissions for CSS, JavaScript, and PHP across tags, attributes, files, and article owners. Additionally, PHP include attributes can escape configured folders, and executable script/style variants may bypass detection.

Impact Analysis

An attacker could exploit this to execute arbitrary PHP code without proper authorization, potentially gaining control over the system. Sensitive data may be accessed or modified, and the integrity of the website could be compromised.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR and HIPAA requirements for data protection and integrity. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update Joomla to the latest version to address the described issues with article PHP execution and permission enforcement.

Hi! I’m here to help you understand CVE-2026-64796. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70