CVE-2026-97163 File upload in UP plugin for Joomla
Unauthenticated attackers can remotely install arbitrary code via the UP plugin for Joomla, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-97163?
CVE-2026-97163 is a critical vulnerability in lomart.fr UP plugin for Joomla, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Which versions are affected by CVE-2026-97163?
It affects 1 product.
Products include Lomart Up.
How do I fix CVE-2026-97163?
No fix has been published for CVE-2026-97163 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-97163 being exploited?
There is no known exploitation of CVE-2026-97163 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in lomart.fr UP plugin for Joomla
Sources
Also known as GHSA-6pgc-8534-jjrf.