Skip to main content
mySites.guru
5+ live

Joomla extension security alerts (22 Aug) Fabrik 4.7.2ZOO: unauth RCEPhoca Cart: unauth SQLiJCE 2.9.99.10SP Page Builder RCE

CVE-2026-65712MediumPublished 22 July 2026

Regular Labs CDN for Joomla (cdnforjoomla) <= 7.3.7 - Path Traversal and Credential Exposure

Regular Labs CDN for Joomla up to and including 7.3.7. CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata (CVE-2026-65712). Also affected by CVE-2026-63265, missing CSRF tokens and permission checks on the shared Regular Labs AJAX endpoints. Note the related Cache Cleaner issue CVE-2026-64874, where CDN credentials were exposed in administrator request URLs, is covered by the Cache Cleaner rule. Fixed in the Regular Labs security release of 22 July 2026 (8.0.0).

Affected versions: ≤ 7.3.7

Official record: cve.org · NVD

Related vulnerabilities

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

Affected extensions and versions

Our disclosure post

Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Regular Labs Patched Its Whole Joomla Extension Catalogue at Once

Regular Labs shipped a security-hardening update across its Joomla extension range on 22 July 2026: SSRF, command injection, stored XSS and more. No CVEs.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

Rules current as of 25 August 2026.