CVE-2026-97163: Joomla lomart.fr UP Plugin RCE Vulnerability

CVE-2026-97163 Overview

CVE-2026-97163 is an unauthenticated remote code installation vulnerability in the Lomart UP plugin extension for Joomla. The flaw affects versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. Attackers can exploit this issue remotely over the network without authentication or user interaction. The underlying weakness is a path traversal defect ([CWE-22]) that permits attackers to install arbitrary code on vulnerable Joomla installations. Successful exploitation results in full compromise of the hosting web application and underlying server context.

Critical Impact
Unauthenticated attackers can remotely install arbitrary code on Joomla sites running the Lomart UP plugin, leading to complete site takeover and potential lateral movement.

Affected Products

Lomart UP plugin extension for Joomla, versions 5.0.0 through 5.2.0
Lomart UP plugin extension for Joomla, versions 6.0.0 through 6.0.29
Joomla CMS installations with the vulnerable UP extension enabled

Discovery Timeline

2026-09-26 - CVE-2026-97163 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97163

Vulnerability Analysis

The vulnerability resides in the Lomart UP plugin extension, a third-party Joomla component distributed by lomart.fr. Attackers can reach the vulnerable code paths over the network without providing credentials. The weakness is classified as a path traversal defect, which the plugin converts into an unauthenticated remote code installation primitive. This grants an attacker the ability to place attacker-controlled files or extensions into locations the Joomla runtime subsequently executes. The practical outcome is arbitrary code execution in the context of the web application, which commonly runs as the web server user.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory ([CWE-22]). The UP plugin accepts file or resource identifiers from unauthenticated requests and uses them in filesystem operations without sufficient canonicalization or allowlist validation. Attacker-supplied sequences escape the intended installation directory and reach writable locations loaded by Joomla. Combined with the plugin's installation logic, this traversal enables remote code placement rather than mere file read or disclosure.

Attack Vector

Exploitation requires only network access to the Joomla site exposing the UP plugin. No authentication, user interaction, or elevated privileges are needed. An attacker sends a crafted HTTP request to the plugin's installation endpoint containing traversal sequences and a payload. The plugin writes attacker-controlled code to a location executed by Joomla, resulting in server-side code execution. See the Lomart Security Overview for vendor information on affected versions.

Detection Methods for CVE-2026-97163

Indicators of Compromise

Unexpected .php files appearing under Joomla components/, plugins/, modules/, or tmp/ directories after HTTP requests to UP plugin endpoints.
HTTP POST or GET requests to Lomart UP plugin URLs containing ../ sequences, URL-encoded %2e%2e%2f, or null-byte variants.
New or modified Joomla extensions registered in the #__extensions table without a corresponding administrator action.
Outbound connections from the web server to unknown hosts shortly after plugin requests, indicating installed webshell callbacks.

Detection Strategies

Inspect web server access logs for requests targeting the UP plugin containing path traversal patterns or unexpected archive uploads.
Compare installed plugin versions against the vulnerable ranges (5.0.0–5.2.0 and 6.0.0–6.0.29) using Joomla's extension manager or database queries.
File integrity monitoring on Joomla webroot to flag new or altered PHP files, especially outside normal deployment windows.

Monitoring Recommendations

Enable WAF logging and alerting for traversal signatures directed at /plugins/ and /administrator/ URIs.
Monitor process creation on the web host for php spawning shells, curl, wget, or compiler invocations.
Centralize web, system, and application logs for correlation and retention sufficient to investigate suspected installations.

How to Mitigate CVE-2026-97163

Immediate Actions Required

Identify all Joomla instances running the Lomart UP plugin and determine installed versions.
Disable the UP plugin in the Joomla administrator interface until a fixed release is confirmed and applied.
Restrict network access to Joomla administrator and plugin endpoints via IP allowlists or VPN while remediation is in progress.
Audit the webroot and database for unauthorized extensions, files, administrator accounts, and scheduled tasks.

Patch Information

Refer to the vendor at Lomart Security Overview for the fixed release corresponding to the 5.x and 6.x branches. Upgrade any installation within the vulnerable ranges (5.0.0–5.2.0, 6.0.0–6.0.29) to a vendor-provided patched version. After patching, rotate Joomla administrator credentials, API tokens, and any secrets stored on the host.

Workarounds

Uninstall or disable the Lomart UP plugin until a patched version is deployed.
Deploy WAF rules that block path traversal sequences and unauthenticated file upload attempts to plugin endpoints.
Set strict filesystem permissions so the web server user cannot write to executable Joomla directories outside of controlled upload paths.

bash

# Example: locate installed UP plugin files and disable write access
find /var/www/joomla -type d -iname '*lomart*' -o -iname '*up*plugin*'
chmod -R a-w /var/www/joomla/plugins /var/www/joomla/modules /var/www/joomla/components