CVE-2026-97163 in UP Extension
Summary
by MITRE • 09/26/2026
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified involves a critical unauthenticated remote code execution flaw within the UP (Ultimate Portfolio) plugin for Joomla, specifically affecting versions ranging from 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. This security defect allows an attacker to upload arbitrary files directly onto the server without requiring any form of authentication or valid session tokens. The root cause lies in insufficient validation of file uploads within the plugin's administrative interface, where the system fails to adequately verify the integrity and type of uploaded assets before processing them for storage on the web server. This lack of rigorous input sanitization creates a direct pathway for malicious actors to inject executable scripts into directories that are accessible via HTTP requests.
From a technical perspective, this vulnerability is classified under CWE-434, which describes the unrestricted upload of files with dangerous types. When an attacker exploits this flaw, they can typically upload PHP web shells or other server-side script formats disguised as legitimate media assets such as images or documents. Because the Joomla installation often runs with sufficient permissions to write to these directories, and because many hosting configurations allow execution of scripts within user-uploaded content folders, the uploaded file becomes immediately executable by the web server process. This effectively grants the attacker full control over the underlying operating system context in which the web application operates, leading to a complete compromise of the targeted environment.
The operational impact of this vulnerability is severe and far-reaching. Once an unauthenticated user gains the ability to execute arbitrary code on the server, they can escalate privileges, exfiltrate sensitive database contents containing user credentials and personal data, deface websites by modifying core files or public-facing pages, and install additional malware such as backdoors, cryptominers, or botnet agents. This type of attack is frequently automated using large-scale scanning tools that probe thousands of Joomla installations daily for known vulnerable extensions. The presence of this flaw significantly increases the risk profile for any organization relying on these specific versions of the UP plugin, potentially resulting in significant financial loss, reputational damage, and regulatory penalties under data protection laws like GDPR if personal information is compromised during the breach.
In terms of industry frameworks, this vulnerability aligns with MITRE ATT&CK technique T1505.003, known as Server Software Component: Web Shell. The attacker's initial access vector corresponds to T1190, Exploit Public-Facing Application, leveraging a publicly accessible interface that lacks proper authentication controls for specific administrative functions. Furthermore, the failure to validate file types and contents reflects weaknesses in input validation mechanisms often cited in CWE-20 Improper Input Validation. Understanding these mappings helps security teams prioritize remediation efforts based on established threat intelligence models rather than treating each instance as an isolated incident.
To mitigate this risk immediately, administrators must upgrade the UP plugin extension to a version newer than 6.0.29 or earlier than 5.0.0 if applicable, ensuring that the vendor's patched code is in place which includes stricter file type filtering and authentication checks for upload endpoints. If immediate upgrading is not feasible due to compatibility constraints with other site components, temporary mitigations should be implemented at the web server level. This can include configuring Apache or Nginx rules to deny execution of PHP scripts within specific directories where user uploads are stored, such as by adding an .htaccess file containing directives that disable script execution in those paths. Additionally, implementing a Web Application Firewall with signatures capable of detecting common upload-based exploitation patterns can provide an additional layer of defense against automated attacks targeting this known vulnerability until the software is fully updated.