Executive brief
The Conditional Content extension for Joomla allows administrators to restrict content visibility using PHP conditions. A vulnerability allows authenticated users with article publishing privileges to execute arbitrary PHP code by embedding it in article conditions, which runs with the permissions of the web server process. This could lead to complete compromise of the Joomla website and underlying server.
Technical details
The vulnerability is a PHP code injection in the Conditional Content Pro extension for Joomla. The extension accepts inline PHP condition rules in article syntax without proper validation of the code author. The vulnerable component fails to verify that only trusted authors can inject PHP; Joomla's text filter preserves the PHP syntax, allowing arbitrary code execution when the article is published. The attack requires authentication and publishing privileges but runs with web-server process permissions. An attacker with author or publisher role can achieve remote code execution by crafting malicious PHP conditions in article content.
Affected products
- Regular Labs Conditional Content < 8.0.0
Timeline
- 2026-09-14: disclosed