CVE-2026-85192: Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0
Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0 - Conditional Content Pro accepts inline PHP Condition Rules in article syntax. In affected versions, the PHP is passed to the Conditions evaluator without checking who authored the article. Joomla's normal Author text filter preserves the syntax, so publishing the article causes the code to run as the web-server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Conditional Content Pro (regularlabs.com)to a version that resolves this vulnerability.Fixed in 8.0.0 - Configuration
Disable support for inline PHP Condition Rules in Conditional Content Pro so PHP provided via article Condition Rules is not evaluated.
Joomla Conditional Content Pro (regularlabs.com) Conditional Content Pro accepts inline PHP Condition Rules in article syntax = disabled - Compensating control
Restrict/limit use of the Conditional Content extension and limit who can publish articles so that only trusted authors can submit content that would otherwise be evaluated by the extension.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs an authenticated Joomla account that can author an article containing inline PHP Condition Rules. The vulnerable extension does not verify who authored the article before passing those rules to its Conditions evaluator.
Does Joomla's normal Author text filtering prevent exploitation?
No. The normal Joomla Author text filter preserves the relevant article syntax, allowing the inline PHP Condition Rules to remain present until the article is published.
When does the injected code execute, and under which account context?
The code executes when the article is published. It runs as the web-server process, so the resulting access is limited by the permissions of that process.