What is CVE-2026-102802 in Joomla extensions?
A critical PHP code injection flaw cataloged as CVE-2026-102802 affects specific configurations of popular Joomla extensions from regularlabs.com visit official site. The vulnerability carries a high CVSS score of 8.9 and involves the Sourcerer extension when paired with Articles Anywhere. Similar critical vulnerabilities in other ecosystems, such as Rust zip library vulnerability, demand rigorous attention to extension updating practices.
The issue arises from how trust and permissions are evaluated when one article is embedded inside another. Sourcerer normally restricts PHP execution based on article author trust, while Articles Anywhere can insert layouts or text between articles.
Who is affected by this PHP injection vector?
Web administrators running Joomla instances with Sourcerer versions prior to 17.0.1 and Articles Anywhere versions prior to 20.1.1 are directly exposed. If an inclusion is processed before Sourcerer and content triggers are not forced, permissions can mismatch.
This security gap permits malicious logic to leverage the enclosing article's trusted identity instead of the restricted identity of the included article author.
How do I protect my site and mitigate the risk?
Mitigating this vulnerability requires prompt updating of the involved components and enforcing content trigger settings. Other platforms like Kaniko credential filtration flaw remind us of the danger of improper validation flows, making proactive patching essential.
- Update the Sourcerer extension to version 17.0.1 or higher.
- Update the Articles Anywhere extension to version 20.1.1 or higher.
- Verify that Force Content Triggers is appropriately enabled to prevent trust mismatch issues.