Threats tagged 'ghsa-6xfh-f8pc-77x8'

A PHP code injection vulnerability exists in the Joomla Sourcerer extension versions prior to 17.0.1 when used in combination with the Articles Anywhere extension versions prior to 20.1.1. The issue arises because Articles Anywhere can insert one article into another, and when processing occurs in a certain order with Force Content Triggers disabled, the included article's Sourcerer code may be executed with the trust level of the enclosing article rather than its own. This creates a mismatch in authority validation for executing PHP code within articles.