CVE-2026-85192: Joomla Conditional Content RCE Vulnerability

CVE-2026-85192 Overview

CVE-2026-85192 is a code injection vulnerability [CWE-94] in the Regular Labs Conditional Content Pro extension for Joomla, affecting versions prior to 8.0.0. The extension accepts inline PHP inside Condition Rules embedded in article syntax. Affected builds pass this PHP to the Conditions evaluator without verifying the article author's privileges. Joomla's default Author text filter preserves the PHP syntax, so publishing a crafted article executes attacker-controlled code as the web-server process.

Critical Impact
An authenticated user with article authoring rights can achieve remote code execution on the Joomla host, resulting in full site compromise.

Affected Products

Regular Labs Conditional Content Pro for Joomla, versions prior to 8.0.0
Joomla sites where the Author group (or higher) is permitted to publish articles
Deployments relying on Joomla's default Author text filter configuration

Discovery Timeline

2026-09-14 - CVE-2026-85192 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85192

Vulnerability Analysis

Conditional Content Pro extends Joomla articles with inline {rl_condition} style syntax that supports PHP-based Condition Rules. The evaluator compiles and executes the supplied PHP fragments when the article is rendered. In versions prior to 8.0.0, the evaluator does not check the authoring user's group or capability before executing the PHP. Any user with permission to create or edit articles can therefore embed arbitrary PHP into the content.

Joomla mitigates untrusted HTML through per-group text filters, but the default Author filter preserves the specific syntax the extension parses. The PHP passes through the filter intact and reaches the Conditions evaluator during page rendering. Execution occurs in the context of the web-server process, giving the attacker access to the Joomla database credentials, filesystem, and any secrets stored on disk.

Root Cause

The root cause is missing authorization on a dangerous sink. The Conditions evaluator treats the PHP payload as trusted regardless of the article author's role. The extension delegates input sanitization to Joomla's text filter, but that filter is not designed to strip extension-specific tags. The result is a classic code injection pattern where untrusted input reaches a eval-equivalent evaluator without a privilege check.

Attack Vector

Exploitation requires an authenticated Joomla account with article publishing rights, which is a common privilege level on multi-author sites. The attacker creates or edits an article, inserts a Condition Rule containing PHP payload, and publishes the article. Rendering the article, either through preview or by any visitor accessing the front end, triggers execution. See the Regular Labs Official Site for the vendor's product documentation.

No verified proof-of-concept code is available. The vulnerability mechanism is documented in prose form only.

Detection Methods for CVE-2026-85192

Indicators of Compromise

Article records in the Joomla #__content table containing Regular Labs Conditional Content syntax with inline PHP tags authored by non-Super-User accounts.
Web-server processes (php-fpm, apache2, httpd) spawning shell interpreters, curl, wget, or reverse shell binaries shortly after article publication.
New or modified PHP files in Joomla directories such as /tmp, /images, or /media that were not deployed by the site administrator.
Outbound network connections from the web server to unfamiliar hosts immediately after content edits in the Joomla administrator panel.

Detection Strategies

Audit stored articles for the Conditional Content tag pattern combined with <?php or short-tag markers, filtering by author user group.
Correlate Joomla com_content save events with process-execution telemetry on the underlying host to detect post-publish command execution.
Alert on web-server user IDs writing to executable file paths or invoking system utilities outside the normal application baseline.

Monitoring Recommendations

Enable Joomla action logging for article create, edit, and publish events, and ship logs to a central store for review.
Monitor filesystem integrity for the Joomla webroot and Regular Labs extension directories.
Track privilege changes in Joomla user groups to detect unauthorized elevation to article authoring roles.

How to Mitigate CVE-2026-85192

Immediate Actions Required

Upgrade Regular Labs Conditional Content Pro to version 8.0.0 or later on all Joomla instances.
Audit the user list for accounts in Author, Editor, Publisher, and custom groups that permit article creation, and remove unnecessary accounts.
Review recent articles for embedded PHP inside Conditional Content syntax and quarantine any suspicious entries.
Rotate database credentials, API tokens, and secrets stored in configuration.php if exploitation is suspected.

Patch Information

Install Conditional Content Pro version 8.0.0 or later, which enforces authorization checks before the Conditions evaluator processes inline PHP. Refer to the Regular Labs Official Site for release notes and download links.

Workarounds

Disable the Conditional Content Pro extension until the patched version is deployed.
Restrict article authoring permissions so that only trusted Super Users can publish content while the extension remains enabled.
Tighten the Joomla text filter for the Author and Editor groups to strip extension-specific tags, acknowledging this is a partial mitigation only.

bash

# Joomla CLI example: disable the Regular Labs Conditional Content plugin
php cli/joomla.php extension:disable --name="Regular Labs - Conditional Content"

# Grep the articles table export for embedded PHP inside Conditional Content syntax
mysqldump -u joomla -p joomla_db \#__content \
  | grep -E "(rl_condition|\{rl_).*<\?php"