CVE-2026-97160: Joomla UP Plugin RCE Vulnerability

CVE-2026-97160 Overview

CVE-2026-97160 is an authenticated PHP command injection vulnerability in the Lomart UP plugin extension for Joomla. The flaw affects versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. An authenticated attacker with high privileges can inject and execute arbitrary PHP code on the server hosting the Joomla application. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation grants attackers arbitrary PHP code execution, leading to complete compromise of the underlying web server, database access, and lateral movement into connected systems.

Affected Products

Lomart UP plugin extension for Joomla versions 5.0.0 to 5.2.0
Lomart UP plugin extension for Joomla versions 6.0.0 to 6.0.29
Joomla installations with the UP extension enabled

Discovery Timeline

2026-09-26 - CVE-2026-97160 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97160

Vulnerability Analysis

The Lomart UP plugin extension contains a code injection flaw that allows authenticated users holding elevated Joomla privileges to inject PHP code into application logic. The injected code is subsequently evaluated by the PHP interpreter at runtime. The condition maps to [CWE-94], which covers improper control over generation of code. Exploitation yields direct execution within the web server process context, enabling arbitrary command execution against the host operating system.

The attack originates over the network and does not require user interaction. However, it requires an authenticated session with high privileges, which limits the attacker population to compromised administrator accounts or malicious insiders. Once exploited, the vulnerability compromises confidentiality, integrity, and availability of the Joomla installation and any downstream systems it connects to.

Root Cause

The root cause is unsafe handling of user-controlled input that is passed into a PHP code generation or evaluation function without adequate sanitization. The plugin treats input from a privileged interface as trusted, allowing crafted payloads to break out of the intended data context into executable code. Refer to the Lomart Security Overview for vendor information.

Attack Vector

An authenticated administrator-level user submits a crafted request to the vulnerable UP plugin endpoint. The request contains PHP syntax within a parameter that the plugin later renders or evaluates as code. The PHP interpreter executes the injected payload with the privileges of the web server process. The attacker can then deploy webshells, read application secrets, pivot to the database, or exfiltrate stored data.

No public exploit code or proof-of-concept has been published at the time of this writing.

Detection Methods for CVE-2026-97160

Indicators of Compromise

Unexpected PHP files or modified .php files inside the Joomla plugins/ directory, especially under paths related to the UP extension.
Web server access logs showing POST requests from administrator sessions containing PHP syntax such as <?php, system(, exec(, passthru(, or eval(.
Outbound network connections initiated by the PHP-FPM or Apache worker process to unfamiliar hosts.
New or modified Joomla administrator accounts created shortly after suspicious plugin interactions.

Detection Strategies

Monitor the Joomla administrator session audit log for unusual activity targeting the UP plugin configuration endpoints.
Deploy file integrity monitoring on the Joomla plugins/, administrator/, and tmp/ directories to catch unauthorized file writes.
Inspect web application firewall (WAF) logs for payloads containing PHP tokens submitted to Joomla administrator URLs.

Monitoring Recommendations

Alert on web server processes spawning shell interpreters such as /bin/sh, /bin/bash, or cmd.exe.
Baseline normal Joomla administrator behavior and alert on anomalous API calls to plugin endpoints.
Forward Joomla and web server logs to a centralized log platform and retain them for at least 90 days to support investigation.

How to Mitigate CVE-2026-97160

Immediate Actions Required

Audit the installed version of the Lomart UP extension and confirm whether it falls within the affected ranges 5.0.0-5.2.0 or 6.0.0-6.0.29.
Rotate credentials for all Joomla administrator accounts and enforce multi-factor authentication on the administrator interface.
Restrict access to the /administrator/ path using IP allowlists or VPN requirements until a patched release is applied.
Review web server and PHP error logs for signs of prior exploitation.

Patch Information

Consult the Lomart Security Overview for the latest fixed release of the UP plugin extension. Upgrade to a version outside the affected ranges as soon as the vendor publishes a remediated build. After patching, review all extensions and files for unauthorized modifications introduced during any window of exposure.

Workarounds

Disable the Lomart UP plugin extension in the Joomla administrator panel until a patched version is available.
Remove the plugin directory from the Joomla installation if the plugin is not business critical.
Apply WAF rules that block requests to Joomla administrator endpoints containing PHP tags or dangerous function names.
Enforce the principle of least privilege and reduce the number of accounts with the elevated Joomla roles required for exploitation.

bash

# Configuration example: temporarily block plugin endpoint at the web server
# Nginx snippet to deny access to the Lomart UP plugin path
location ~* /plugins/system/up/ {
    deny all;
    return 403;
}