CVE-2026-100750
Received Received - Intake

Local File Inclusion in Modules Anywhere Joomla Extension

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Joomla! Project

Description
Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter. Joomla's core Feed module provides a concrete affected path: its rssurl parameter is opened by the server and accepts local file: URLs as well as network URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-100750
EUVD
EUVD-2026-88107

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
regularlabs modules_anywhere 1.5.0
joomla joomla *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Local File Inclusion (LFI) or Server-Side Request Forgery (SSRF) flaw in the Modules Anywhere Joomla extension versions 1.5.0 to 9.0.5. It allows attackers to inject module tags with arbitrary parameters that can replace core module settings. The issue occurs because the extension applies these overrides without verifying the content author, enabling potential manipulation of module behavior.

Impact Analysis

An attacker could exploit this to read sensitive files on the server or make unauthorized network requests. For example, if the Feed module is used, an attacker could force it to fetch local files or remote URLs, potentially exposing internal data or enabling further attacks depending on module configurations.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance failures may result in legal penalties, reputational damage, and mandatory breach notifications depending on affected data scope.

Mitigation Strategies

Update the Modules Anywhere extension to the latest version that patches this vulnerability. If immediate update is not possible, disable the extension or restrict access to Joomla's Feed module to prevent SSRF/LFI attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100750. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart