CVE-2026-64796 | Joomla Extension - regularlabs.com - various code injection … | CVSS 9.8 CRITICAL

Description

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

Metadata

CVE ID: CVE-2026-64796
State: PUBLISHED
Assigner: Joomla
Reserved: 2026-07-20 18:16 UTC
Published: 2026-07-22 20:42 UTC
Last updated: 2026-07-28 05:34 UTC
Primary CWE: CWE-284
CWE-284 Improper Access Control
Vendor / Product: regularlabs.com / Sourcerer extension for Joomla
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
regularlabs.com	Sourcerer extension for Joomla	—	1.0.0-12.2.8

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284 Improper Access Control

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://regularlabs.com/