Sourcerer (sourcerer) below 13.0.0 - Code Execution (CVE-2025-22204) and PHP/Script Privilege Escalation

Regular Labs Sourcerer is affected by two lines of security issue. (1) CVE-2025-22204: improper control of code generation leading to code execution in versions before 11.0.0. (2) The coordinated Regular Labs security release of 22 July 2026 (Sourcerer 13.0.0) restricts PHP in articles to content created and last modified by Super Users, enforces the configured CSS/JavaScript/PHP permissions across tags, attributes, files and both article creators and modifiers, restricts PHP includes to the configured include folder, and fixes script/style security checks that missed executable tag variants - collectively a set of privilege-escalation and code/markup-execution hardening fixes. No CVE was assigned to the 22 July issues. Update to Sourcerer 13.0.0 or later. Note: 13.0.0 preserves your existing Pro security settings on update, so review them to opt into the new stricter defaults. CVE ids assigned by the Joomla CNA for this extension in the 22 July 2026 Regular Labs security release: CVE-2026-64796. Sites on this version range are ALSO within the affected range of CVE-2026-74253 (Sourcerer before 14.0.0, CVSS 4.0 10.0 Critical, unauthenticated remote code execution through unverified reflected code, CWE-94, credited to Lukasz Rybak), whose CNA record covers 1.0.0 to 13.1.1. Updating to 13.0.0 is therefore no longer sufficient: update to 14.0.0 or later. If you cannot update immediately, disable the Sourcerer system plugin, which is the plugin that renders Sourcerer tags.

Affected versions: ≤ 12.2.8

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions