--- title: "CVE-2026-102802: Joomla Extension regularlabs.com - Command Injection" description: "Joomla Extension regularlabs.com Sourcerer < 17.0.1 used with Articles Anywhere < 20.1.1 contains a PHP code injection caused by improper trust evaluation in article inclusion, letting attackers execute PHP code with elevated article-author privileges, exploit requires specific extension combination and configuration." url: https://panop.io/threat-heartbeat/CVE-2026-102802/ --- # CVE-2026-102802 Joomla Extension regularlabs.com - Command Injection Joomla Extension regularlabs.com Sourcerer < 17.0.1 used with Articles Anywhere < 20.1.1 contains a PHP code injection caused by improper trust evaluation in article inclusion, letting attackers execute PHP code with elevated article-author privileges, exploit requires specific extension combination and configuration. CVSS base score 8.9 /10 High CISA KEV Not listed Public exploit None known [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-102802) ## Details Type Command Injection Impact Remote Code Execution CVSS vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Published 2 November 2026 Updated 3 November 2026 Weakness [CWE-94](https://cwe.mitre.org/data/definitions/94.html) ## Vendor fix Update Sourcerer to version 17.0.1 or later and Articles Anywhere to version 20.1.1 or later. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-102802](https://nvd.nist.gov/vuln/detail/CVE-2026-102802) - [https://www.regularlabs.com/](https://www.regularlabs.com/) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)