CVE-2026-102802: Code Injection

Q: Which deployments are exposed to this issue?

Exposure requires both Sourcerer below 17.0.1 and Articles Anywhere below 20.1.1. The problematic path occurs when Articles Anywhere processes an article inclusion before Sourcerer and Force Content Triggers is disabled.

Q: What access would an attacker need to take advantage of the authorization gap?

An attacker would need to place Sourcerer PHP code in an article that is included into another article. Exploitation depends on that included content being evaluated under the identity of a trusted creator or last editor of the enclosing article rather than the identity associated with the article supplying the code.

Q: How can administrators identify potentially affected content?

Review sites running the affected extension versions for Articles Anywhere inclusions that pull text or full layouts from other articles. Prioritize cases where included articles contain Sourcerer PHP code and the enclosing article has a creator or last editor trusted to run PHP.

Published Nov 2, 2026

Updated

Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.

Event History

Nov 2, 2026

CVE Published

via NVD·02:17 PM

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Exposure requires both Sourcerer below 17.0.1 and Articles Anywhere below 20.1.1. The problematic path occurs when Articles Anywhere processes an article inclusion before Sourcerer and Force Content Triggers is disabled.

What access would an attacker need to take advantage of the authorization gap?

An attacker would need to place Sourcerer PHP code in an article that is included into another article. Exploitation depends on that included content being evaluated under the identity of a trusted creator or last editor of the enclosing article rather than the identity associated with the article supplying the code.

How can administrators identify potentially affected content?

Review sites running the affected extension versions for Articles Anywhere inclusions that pull text or full layouts from other articles. Prioritize cases where included articles contain Sourcerer PHP code and the enclosing article has a creator or last editor trusted to run PHP.

CVE-2026-102802: Code Injection

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access would an attacker need to take advantage of the authorization gap?

How can administrators identify potentially affected content?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access would an attacker need to take advantage of the authorization gap?

How can administrators identify potentially affected content?