Local File Inclusion and Server-Side Request Forgery in Joomla Extension by Regular Labs

CVE-2026-100750

What is CVE-2026-100750?

The Modules Anywhere extension by Regular Labs is susceptible to local file inclusion (LFI) and server-side request forgery (SSRF) due to its handling of module tag attributes. This feature allows users to replace arbitrary parameters of a selected module, a functionality that is enabled by default in the vulnerable versions. The vulnerability arises because the parameters are modified without proper access control. As a result, if exploited, it can lead to unauthorized access to local files or sensitive data on the server. This issue notably impacts Joomla's core Feed module, which exposes the rssurl parameter, permitting access to both local file URLs and external network URLs.

References