Modules Anywhere EUVD-2026-88107

Requires Modules Anywhere Pro (versions 1.5.0 through 9.0.5) installed on Joomla, where the parameter-override feature is enabled by default. The attacker must have privileges to author content containing a Modules Anywhere module tag, and the selected module must consume the replaced parameter unsafely - the core Feed module's rssurl (which the server opens and accepts file: and network URLs for) is the concrete confirmed path. Limiting factors: authenticated content-authoring access is needed (not unauthenticated), and impact depends on the target module; a hardened deployment disabling the override feature or restricting the Feed module reduces exposure.

The vendor-supplied CVSS 4.0 vector (8.5, AV:N/AC:L/PR:H/UI:N) rates this high, but the metric weighting is questionable and the real-world priority is moderate. The vulnerability is a CWE-918 SSRF/LFI in Regular Labs 'Modules Anywhere Pro' (1.5.0-9.0.5) where module-tag override attributes bypass author checks; the core Joomla Feed module's rssurl parameter then opens file:// (local file read) or arbitrary network URLs (SSRF). Notably the vendor set VC:N (no confidentiality) yet VI:H/SI:H/SC:H - this is inconsistent with a file-read/LFI primitive, whose dominant impact is confidentiality (disclosure of local files and internal responses); verify impact weighting with the vendor. Exploitation requires authenticated content-authoring privileges (PR:H/PR:L), so it is not a pre-auth mass-exploitation candidate. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no public exploit identified at time of analysis. Net: a genuine authenticated LFI/SSRF worth patching, but not an urgent internet-wide threat - priority is tempered by the authentication requirement and the paid-Pro-extension footprint.

An attacker with content-authoring access to a Joomla site running Modules Anywhere Pro embeds a module tag that selects the core Feed module and overrides its rssurl attribute with a file:// path or an internal network URL. The server opens the supplied URL and renders the response into the page, disclosing local file contents or internal service data. No public proof-of-concept is identified in the available data.