What happened
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Affected versions
UP plugin for Joomla: 5.0.0-5.2.0; 6.0.0-6.0.29 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
RepositoryAuthorFirst seenReference
SploitusUnauthenticated remote code installation in UP 5.0.0–5.2.0 and 6.0.0–6.0.29 via GitHub.murrez2026-09-26T20:55:27Verifiedmurrez/CVE-2026-97163CVE-2026-97163 PoC: Joomla UP (lomart.fr) unauthenticated GitHub mini-install / remote action deployment (≤6.0.29). Detects plugin version, probes com_ajax install triggers. Fix: UP 6.1.0 / 5.2.1. https://pocbit.org/pocs/cve-2026-97163★ 1murrez2026-09-26VerifiedSploitusAuthenticated PHP code injection in UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 via shortcodes.murrez2026-09-26T20:46:20Verifiedmurrez/CVE-2026-97160Authenticated PHP code injection in UP plugin 5.0.0–5.2.0 and 6.0.0–6.0.29 via shortcodes.murrez2026-09-26T20:46:20Verifiedqeize/cve-2026-97163-payloadCVE-2026-97163 PoC payload (UP plugin Joomla remote code installation)★ 0qeize2026-09-26VerifiedSource timeline
CVE record published by NVDView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.