CVE-2026-102802
Last modified
CVE-2026-102802 is a high-severity vulnerability rated 8.9/10 on the CVSS scale. Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another.
Description
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| regularlabs.com | Sourcerer Free extension for Joomla | 13.0.0-17.0.0 |
| regularlabs.com | Sourcerer Pro extension for Joomla | 3.0.0-17.0.0 |
| regularlabs.com | Articles Anywhere extension for Joomla | 1.4.5-20.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-102802?
How severe is CVE-2026-102802?
How do I fix CVE-2026-102802?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-102797Server-Side Request Forgery (SSRF) vulnerability in ThemeREX…6.4
- CVE-2026-102798Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2026-102799Joomla Extension - icagenda.com - CSV formula injection in t…5.3
- CVE-2026-10280A security flaw has been discovered in horizon921 mcpilot 0.…7.3
- CVE-2026-102800Joomla Extension - dj-extensions.com - Unauthenticated Store…8.7
- CVE-2026-102801Joomla Extension - regularlabs.com - Exposure of Sensitive I…5.1
- CVE-2026-102804A vulnerability was detected in Nothings stb up to 2c980bb59…6.5
- CVE-2026-102805A flaw has been found in Nothings stb up to 1.16. This affec…6.5
- CVE-2026-102806OpenClaw before 2026.9.5 contains an incorrect authorization…6.3
- CVE-2026-102807OpenClaw before 2026.9.4 contains an incorrect authorization…5.3
- CVE-2026-102808PX4 Autopilot through 1.17.0 contains a NULL pointer derefer…6.5
- CVE-2026-102809PX4 Autopilot through 1.17.0 contains an uncontrolled stack …6.5
Are you affected by CVE-2026-102802?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST