Executive brief
A vulnerability in the Sourcerer extension for Joomla allows users with lower privileges to execute custom PHP code, which should normally be restricted to administrators. This could allow an attacker to take full control of the website, access sensitive database information, or disrupt services. The issue stems from insufficient checks on who created or modified content containing executable code.
Technical details
The Sourcerer extension for Joomla (Free and Pro versions) contains multiple access control vulnerabilities (CWE-284). In the Free version, the system fails to verify that both the creator and the last modifier of an article are Super Users before executing embedded PHP code. In the Pro version, configured permissions for CSS, JavaScript, and PHP are inconsistently enforced across various tags and attributes. Additionally, PHP include attributes are susceptible to path traversal, allowing them to escape the designated include folder, and certain script/style variants can bypass detection mechanisms. These flaws collectively allow for remote code execution (RCE) by users with article editing permissions.
Affected products
- Regular Labs Sourcerer extension for Joomla 1.0.0 through 12.2.8
Timeline
- 2026-07-22: disclosed
- 2026-07-22: advisory