CVE-2026-97161: Joomla UP Plugin Path Traversal Flaw

CVE-2026-97161 Overview

CVE-2026-97161 is a path traversal vulnerability [CWE-22] affecting the Lomart UP plugin extension for Joomla. The flaw affects UP plugin versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. Attackers can exploit multiple file access vectors to read sensitive files outside the intended web directory. The vulnerability requires no authentication and can be triggered remotely over the network.

Critical Impact
Unauthenticated remote attackers can traverse the file system and access arbitrary files on Joomla sites running vulnerable UP plugin versions, exposing configuration data, credentials, and other sensitive content.

Affected Products

Lomart UP plugin extension for Joomla, versions 5.0.0 to 5.2.0
Lomart UP plugin extension for Joomla, versions 6.0.0 to 6.0.29
Joomla installations with the vulnerable UP plugin enabled

Discovery Timeline

2026-09-26 - CVE-2026-97161 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97161

Vulnerability Analysis

The Lomart UP plugin for Joomla contains multiple path traversal vectors that allow attackers to access files outside the intended directory scope. The extension accepts file path parameters without validating directory traversal sequences such as ../. An unauthenticated attacker can craft HTTP requests that navigate the server file system and retrieve arbitrary files readable by the web server process. Because the attack vector is network-based and requires no privileges or user interaction, exploitation can be fully automated against exposed Joomla sites.

The scope impact extends beyond the vulnerable component itself. Successful exploitation can expose Joomla configuration.php files containing database credentials, session secrets, and other sensitive runtime data. The EPSS score is 0.416% as of 2026-09-29, indicating moderate predicted exploitation activity.

Root Cause

The root cause is insufficient input validation on file path parameters processed by the UP plugin extension. The plugin fails to canonicalize user-supplied paths and does not restrict file access to an allowlisted base directory. This maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Attackers deliver crafted HTTP requests containing directory traversal sequences to vulnerable UP plugin endpoints. No authentication, session, or user interaction is required. The vulnerability can be probed by sending requests with path parameters that include traversal sequences, then observing the response for file contents returned from outside the plugin's intended directory. Refer to the Lomart Security Overview for vendor-published technical details.

Detection Methods for CVE-2026-97161

Indicators of Compromise

HTTP request logs containing ../ or URL-encoded traversal sequences (%2e%2e%2f, ..%2f) targeting Joomla UP plugin endpoints
Unexpected read access to sensitive Joomla files such as configuration.php, /etc/passwd, or log files from the web server process
Anomalous outbound traffic following suspicious file access, indicating credential exfiltration

Detection Strategies

Inspect Joomla access logs for requests to UP plugin URLs containing path traversal patterns or encoded variants
Deploy web application firewall (WAF) rules that block traversal sequences in query parameters and POST bodies
Correlate file integrity monitoring events with HTTP request logs to identify suspicious reads originating from the web user

Monitoring Recommendations

Enable verbose request logging on Joomla sites running the UP plugin and forward logs to a centralized analytics platform
Alert on repeated 200-response reads of sensitive configuration files from the web server account
Monitor the UP plugin version string across the Joomla estate to identify unpatched installations

How to Mitigate CVE-2026-97161

Immediate Actions Required

Inventory Joomla installations and identify any site running UP plugin versions 5.0.0-5.2.0 or 6.0.0-6.0.29
Disable the UP plugin extension on affected sites until a patched version is installed
Rotate Joomla database credentials and session secrets if evidence of configuration.php disclosure exists
Review web server logs for the past 90 days for traversal exploitation attempts

Patch Information

Consult the Lomart Security Overview for the vendor's current advisory and patched release information. Upgrade the UP plugin to a version above 5.2.0 in the 5.x branch or above 6.0.29 in the 6.x branch once the vendor publishes a fixed release.

Workarounds

Disable the Lomart UP plugin extension in the Joomla administrator panel until patched
Deploy WAF rules that block path traversal sequences such as ../, ..\, and their URL-encoded forms on UP plugin endpoints
Restrict web server file system permissions so the Joomla process cannot read files outside the web root
Place the Joomla site behind an authenticated reverse proxy if public access is not required

bash

# Example WAF rule to block path traversal on UP plugin endpoints (ModSecurity)
SecRule REQUEST_URI "@contains /plugins/up/" \
    "id:1009161,phase:2,deny,status:403,\
    chain,msg:'CVE-2026-97161 traversal attempt'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.\\|%2e%2e(%2f|%5c))" \
        "t:lowercase,t:urlDecodeUni"