CVE-2026-64796

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64796", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "state": "PUBLISHED", "assignerShortName": "Joomla", "dateReserved": "2026-07-20T18:16:31.593Z", "datePublished": "2026-07-22T20:42:49.934Z", "dateUpdated": "2026-07-28T05:34:08.793Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Sourcerer extension for Joomla", "vendor": "regularlabs.com", "versions": [{"status": "affected", "version": "1.0.0-12.2.8"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection."}], "value": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection."}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242: Code Injection"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2026-07-28T05:34:08.793Z"}, "references": [{"tags": ["product"], "url": "https://regularlabs.com/"}], "source": {"discovery": "UNKNOWN"}, "title": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T18:43:32.469953Z", "id": "CVE-2026-64796", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T18:43:50.952Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-64796", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T18:43:32.469953Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T18:43:46.172Z"}}], "cna": {"title": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242: Code Injection"}]}], "affected": [{"vendor": "regularlabs.com", "product": "Sourcerer extension for Joomla", "versions": [{"status": "affected", "version": "1.0.0-12.2.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://regularlabs.com/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.", "supportingMedia": [{"type": "text/html", "value": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "shortName": "Joomla", "dateUpdated": "2026-07-28T05:34:08.793Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64796", "state": "PUBLISHED", "dateUpdated": "2026-07-28T05:34:08.793Z", "dateReserved": "2026-07-20T18:16:31.593Z", "assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586", "datePublished": "2026-07-22T20:42:49.934Z", "assignerShortName": "Joomla"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Sourcerer extension for Joomla", "vendor": "regularlabs.com", "versions": [{"status": "affected", "version": "1.0.0-12.2.8"}]}], "source": "security@joomla.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection."}, {"lang": "es", "value": "Extensi\u00f3n de Joomla - regularlabs.com - varios vectores de inyecci\u00f3n de c\u00f3digo en la extensi\u00f3n Sourcerer - La versi\u00f3n gratuita no requer\u00eda que tanto el creador del art\u00edculo como el \u00faltimo modificador fueran Superusuarios antes de ejecutar el PHP del art\u00edculo. La versi\u00f3n Pro no aplicaba consistentemente los permisos configurados de CSS, JavaScript y PHP en etiquetas, atributos, archivos y ambos propietarios de art\u00edculos. Los atributos de inclusi\u00f3n de PHP tambi\u00e9n pod\u00edan escapar de la carpeta de inclusi\u00f3n configurada, y las variantes de script/estilo ejecutables pod\u00edan eludir la detecci\u00f3n."}], "id": "CVE-2026-64796", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64796", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T18:43:32.469953Z", "version": "2.0.3"}}]}, "published": "2026-07-22T21:18:10.763", "references": [{"source": "security@joomla.org", "url": "https://regularlabs.com/"}], "sourceIdentifier": "security@joomla.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security@joomla.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.0.0-12.2.8"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Sourcerer extension for Joomla", "source": "cna", "vendor": "regularlabs.com"}, "product": "sourcerer_extension_for_joomla", "vendor": "regularlabs.com"}], "created": "2026-07-23T18:15:12.981331+00:00", "updated": "2026-08-02T17:30:17.758173+00:00", "vendors": ["regularlabs.com", "regularlabs.com$PRODUCT$sourcerer_extension_for_joomla"]}