CVE-2026-97160 Code injection in UP plugin for Joomla
Authenticated privileged users can execute arbitrary PHP code via command injection in the UP plugin for Joomla.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-97160?
CVE-2026-97160 is a critical code injection vulnerability in lomart.fr UP plugin for Joomla, published on 26 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Weakness: CWE-94
Which versions are affected by CVE-2026-97160?
It affects 1 product.
Products include Lomart Up.
How do I fix CVE-2026-97160?
No fix has been published for CVE-2026-97160 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-97160 being exploited?
There is no known exploitation of CVE-2026-97160 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in lomart.fr UP plugin for Joomla
Sources
Also known as GHSA-4h74-hj22-v78v.