Skip to content
OpenAdvisories
Critical · 10.0 CVE-2026-74253 EUVD-2026-60307GHSA-23wq-9cpv-vp32

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0

Published Aug 17, 2026 · Updated Aug 26, 2026 · Assigned by Joomla

Description

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 16.0.0 - Regular Labs Sourcerer before 16.0.0 processes {source} blocks found in Joomla’s final rendered HTML without reliably determining where that code originated.

Affected products

VendorProductAffectedFixed
regularlabs.com Sourcerer extension for Joomla 1.0.0-15.0.0 —

References