EUVD-2026-60307
GHSA-23wq-9cpv-vp32
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity code injection with full RCE impact; scope changed (S:C) because injected code executes in the underlying host beyond the plugin boundary.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.
AnalysisAI
Remote code execution in Regular Labs Sourcerer for Joomla (versions before 14.0.0) allows unauthenticated attackers to inject and execute arbitrary PHP via {source} blocks. The extension parses {source} tags found anywhere in Joomla's final rendered HTML without reliably verifying where that content originated, so attacker-controlled reflected input reaching the page body gets evaluated as trusted code. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Joomla site have the Regular Labs Sourcerer plugin (version < 14.0.0) installed and enabled, AND that attacker-supplied input be reflected into the final rendered HTML of a page that Sourcerer processes - the {source}...{/source} block must reach the output body so the plugin evaluates it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated high-CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a request whose parameter value contains a crafted {source}<malicious PHP>{/source} payload to a Joomla page that reflects that input into its rendered HTML (for example a search results or error page). When Sourcerer processes the final output it treats the reflected marker as trusted embedded code and executes the attacker's PHP on the server, yielding remote code execution. … |
| Remediation | Vendor-released patch: 14.0.0 - upgrade Regular Labs Sourcerer to 14.0.0 or later, which corrects how the plugin verifies the origin of {source} blocks. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all Joomla installations to identify which systems have Regular Labs Sourcerer enabled and determine version numbers; flag all internet-facing instances as critical priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary PHP code execution in the Regular Labs Sourcerer extension for Joomla versions 1.0.0 through 12.2.8 allows rem
We need to produce a JSON object with all fields as plain-text strings. Input: CVE-2026-63265. Description: Privileged R
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administra
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today