Regular Labs Snippets CVE-2026-88852

Exploitation requires three concurrent conditions: (1) the attacker holds a Joomla author account or equivalent low-privilege role capable of creating or editing articles that include Snippets tags; (2) a higher-trusted Snippet author has previously defined and published at least one Snippet template that exposes a security-sensitive output position - specifically the url option - to user-supplied variable substitution from article tag calls; and (3) a privileged user (administrator, manager, or editor) subsequently views the article containing the malicious tag call in their browser. The critical limiting factor is condition (2): sites where all Snippet templates produce fully static output, or where no Snippet template exposes the url option to variable input, are not exploitable. Default Joomla installations without the Regular Labs Snippets extension installed are entirely unaffected.

The reported CVSS 4.0 base vector scores 7.5 (High), but the PR:H metric appears to overstate the attacker's required privilege - a Joomla 'author' is a relatively low-trust role (analogous to PR:L in CVSS 3.1 terms), meaning the attack is accessible to a broader set of site contributors than the score implies. The AT:P metric correctly flags that exploitation is contingent on a trusted Snippet author having published a Snippet template that exposes a security-sensitive position (such as the url option) to variable substitution - this is a non-universal but not unusual configuration in sites using Snippets extensively. No EPSS score was provided and no public exploit or KEV listing exists, leaving exploitation probability unquantified based on available data. Practically, even a mid-sized municipal IT team in malbork running a multi-author Joomla deployment should treat this as a genuine internal privilege-escalation path: a disgruntled or compromised author account could silently plant a payload that captures an administrator's session the next time they review content. The conditional nature of the attack (dependent on how Snippets are configured) reduces indiscriminate exploitation risk, but targeted abuse within a known site architecture is straightforward.

An attacker with a Joomla author account identifies a published Snippet definition that uses the url option as a user-supplied variable placeholder. They craft an article containing a Snippets tag call that passes a javascript: URI as the url value, then publish or submit the article. When a site administrator browses to the rendered article - for example, during a routine editorial review - the malicious script executes in the administrator's browser, exfiltrating the session cookie to an attacker-controlled endpoint and enabling full administrative takeover of the Joomla site. No public proof-of-concept has been identified at time of analysis, but the attack pattern requires only familiarity with Joomla's Snippets tag syntax.