CVE-2026-100750

HighCVSS 8.5

Published: 28/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

Joomla Extension regularlabs.com Modules Anywhere versions 1.5.0 - 9.0.5 for Joomla is vulnerable to LFI / SSRF. Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter; Joomla's core Feed module opens the rssurl parameter server-side and accepts local file: URLs as well as network URLs.

Risk Assessment

An attacker can exploit this vulnerability to read local files or perform SSRF requests, potentially leading to disclosure of sensitive information or interaction with internal services. The feature is enabled by default in affected versions.

Recommendation

Upgrade Modules Anywhere to a version later than 9.0.5 that fixes this vulnerability. If upgrade is not possible, disable the module parameter override feature.

Other vulnerabilities in Modules Anywhere

CVE-2026-65757High
The Joomla Extension Modules Anywhere from regularlabs.com has inconsistent CSRF token checks and privilege checks. The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

Original NVD description (English source)

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied without checking who authored the content containing the tag. The security effect depends on how the selected module consumes the replaced parameter. Joomla's core Feed module provides a concrete affected path: its rssurl parameter is opened by the server and accepts local file: URLs as well as network URLs.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS