Unauthenticated Remote Code Execution in Joomla UP Plugin

The UP (Universal Plugin) for Joomla, developed by lomart.fr, contains a critical vulnerability (CVE-2026-97163) allowing unauthenticated remote code execution. The vulnerability exists in the plugin's "mini" package, which features an on-demand download mechanism for action code hosted on GitHub. During this process, the plugin fetches and unpacks remote ZIP archives into plugins/content/up/actions/, where the PHP code is subsequently executed by the Joomla framework.

Crucially, the plugin implementation fails to perform TLS certificate verification during these GitHub requests, and it lacks sufficient authorization controls for the installation trigger. This allows a network-positioned attacker (performing a Man-in-the-Middle attack) to intercept the request and inject a malicious archive. Exploitation results in the installation of arbitrary PHP code. The vulnerability impacts UP versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. Security patches have been released in versions 5.2.1 and 6.1.0, which enforce authorization and restore TLS verification.

Attack Chain

1. Attacker performs reconnaissance to identify Joomla instances running the vulnerable UP plugin using indicators like plugins/content/up/actions/ in HTTP traffic.
2. Attacker positions themselves as a Man-in-the-Middle between the target Joomla server and GitHub (e.g., via DNS spoofing or BGP hijacking).
3. Attacker triggers the plugin's on-demand action installation by sending an unauthenticated request to a component or endpoint that invokes the up plugin action loader.
4. The vulnerable plugin initiates a request to the attacker-controlled or spoofed GitHub URL to download an action pack.
5. Due to the lack of TLS certificate validation, the plugin accepts a malicious ZIP archive provided by the attacker.
6. The plugin automatically extracts the contents of the malicious archive into the plugins/content/up/actions/ directory.
7. Attacker triggers the newly installed malicious PHP code by navigating to the corresponding plugin action path on the Joomla server.
8. Final objective is achieved: remote code execution under the privileges of the web server user.

Impact

Successful exploitation results in full remote code execution on the underlying web server, potentially leading to total system compromise, data exfiltration, and lateral movement within the hosting infrastructure. The vulnerability is rated with a CVSS 4.0 score of 10.0, indicating the highest level of severity.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Patch Joomla UP plugin to version 5.2.1 or 6.1.0 immediately to enforce authorization and secure the fetch mechanism.
• Implement the Sigma rule provided below to detect anomalous web requests targeting the UP plugin's installation or rendering endpoints.
• Audit the plugins/content/up/actions/ directory for any unexpected files or folders that were not part of the legitimate plugin deployment.
• Deploy network-layer inspection to identify unexpected outbound traffic from web servers targeting GitHub or unknown domains when initiated by the web application process.