CVE-2026-102802 in Articles Anywhere Extension
Summary
by MITRE • 11/02/2026
Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Joomla extensions Sourcerer by regularlabs.com, specifically versions prior to 17.0.1 when combined with Articles Anywhere versions prior to 20.1.1, represents a critical logic flaw involving privilege escalation through context confusion. This issue stems from the interaction between two distinct components that handle content processing and PHP execution within the Joomla CMS environment. Sourcerer is designed to allow users to embed dynamic PHP code directly into article bodies, while Articles Anywhere facilitates the inclusion of one article's content or layout into another. The security failure occurs during the parsing sequence when these extensions are used in tandem under specific configuration conditions, leading to a bypass of intended access controls and trust boundaries.
At its core, this vulnerability is an instance of CWE-20: Improper Input Validation, specifically manifesting as a context confusion error where the system fails to correctly associate code execution privileges with the originating content source. Sourcerer implements a security model based on article-author trust levels, restricting PHP execution in articles according to the author's permissions or specific configuration rules that vary by release version. This mechanism is intended to prevent untrusted users from executing arbitrary server-side scripts within their published content. However, when Articles Anywhere processes an inclusion before Sourcerer and with Force Content Triggers disabled, it inserts the raw text of a source article into a target article without properly isolating the execution context. Consequently, if the included article contains PHP code wrapped in Sourcerer tags, that code is evaluated not under the trust level of its original author, but rather under the authority of the enclosing article's creator or editor who published it.
The operational impact of this flaw allows an attacker with lower privileges to execute high-privilege actions by embedding malicious PHP payloads within a low-trust article and having them included in a higher-trust article via Articles Anywhere. Since ordinary output from Articles Anywhere is not the issue, the attack vector relies entirely on the misinterpretation of code ownership during the rendering pipeline. An attacker could craft an article containing destructive or exfiltrative PHP scripts, such as those leveraging CWE-94: Improper Control of Generation of Code (Code Injection), and publish it in a restricted area. When another user with elevated privileges includes this article on their own page, the embedded code executes with the higher privilege level, effectively bypassing the author-based restrictions enforced by Sourcerer. This can lead to full server compromise, data theft, or defacement depending on the capabilities of the injected PHP code and the permissions granted to the enclosing article's author.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability facilitates lateral movement within the application layer and privilege escalation. It aligns with T1059: Command and Scripting Interpreter, as it allows for arbitrary command execution through PHP scripts embedded in content. Furthermore, because it involves bypassing intended access controls to gain higher privileges, it relates to T1078: Valid Accounts or more specifically the abuse of legitimate application features to escalate rights without direct authentication flaws. The flaw highlights a common architectural weakness where modular extensions fail to maintain strict separation of concerns regarding security contexts during content aggregation operations.
Mitigation strategies must focus on immediate version updates and configuration adjustments. Administrators should upgrade Sourcerer to version 17.0.1 or later and Articles Anywhere to version 20.1.1 or later, as these releases address the logic gap in how inclusion contexts are handled relative to code execution policies. In environments where upgrading is not immediately feasible, disabling Force Content Triggers may alter the processing order but does not fully resolve the underlying context confusion; therefore, relying solely on configuration changes is insufficient. A more robust interim measure involves restricting the use of Articles Anywhere for including content from untrusted sources or limiting which users can create articles that are eligible for inclusion by other high-privilege users. Additionally, implementing strict input validation and output encoding at the application level can help mitigate some risks associated with code injection, although they do not fix the root cause of the trust boundary violation. Regular auditing of extension configurations and monitoring for unusual PHP execution patterns in logs are recommended to detect potential exploitation attempts.