CVE-2026-64796

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-647977.5Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without CVE-2026-647989.1Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a nCVE-2026-647997.5Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlledCVE-2026-648005.7In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by defaultCVE-2026-648027.8In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integrationCVE-2026-648037.8In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDKCVE-2026-648048.4In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingCVE-2026-648058.4In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager toCVE-2026-648068.4In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpretCVE-2026-648077.8In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configurationCVE-2026-648088.4In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolingCVE-2026-648098.4In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
CVE-2026-64796: Critical severity, CVSS 9.8 | Vulnix