CVE-2026-64796
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Sourcerer extension for Joomla! by regularlabs.com has multiple code injection vectors: Free version does not require both article creator and last modifier to be Super Users before executing PHP; Pro inconsistently enforces CSS, JavaScript, and PHP permissions; PHP include attributes can escape the configured folder; executable script/style variants can bypass detection.
Risk Assessment
Attackers can execute unauthorized PHP, CSS, or JavaScript code, leading to account takeover, data theft, or website defacement.
Recommendation
Immediately update the Sourcerer extension to the latest version and carefully configure permissions for all content types.
Original NVD description (English source)
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.