CVE-2026-97161 — Joomla UP Plugin Unauthenticated Path Traversal / File Read

Overview

CVE-2026-97161 affects the UP (Universal Plugin) for Joomla (plg_content_up, lomart.fr). Versions 5.0.0–5.2.0 and 6.0.0–6.0.29 expose unauthenticated path traversal / arbitrary file read through AJAX file-access handlers (notably the ajax-view popup loader). Attackers could read configuration.php and other server-readable files. CVSS 4.0 9.2 Critical (PR:N). Fix: UP 6.1.0 / 5.2.1. Assigner: Joomla CNA.

The same advisory release also addressed arbitrary file creation outside intended directories (same CVE family).

Related: CVE-2026-97160 (PHP code injection), CVE-2026-97162 (SQLi), CVE-2026-97163 (GitHub mini-install).

| | | |---|---| | Product | UP plugin (plg_content_up) | | Affected | 5.0.0–5.2.0, 6.0.0–6.0.29 | | Fixed | 5.2.1, 6.1.0 | | Vector | com_ajax + UP — user-controlled path to ajax-view backend | | Impact | Confidentiality (e.g. DB creds via configuration.php) |

Open source PoC: https://github.com/murrez/CVE-2026-97161

Vendor did not publish exact query strings; the bundled tool fingerprints UP, probes common com_ajax parameter shapes, or accepts --ajax-url from your lab capture.

Bundled tool (Python 3)

pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --read-probe
python poc.py -u https://joomla.example --mode exploit --read-probe
python poc.py -u https://joomla.example --mode exploit --ajax-url "https://joomla.example/index.php?option=com_ajax&plugin=up&..."
python poc.py --list targets.example.txt --mode check --read-probe -j 8

Asset discovery

body="plugins/content/up"
body="com_ajax" "up.lomart"

Impact

Unauthenticated disclosure of Joomla database credentials and other readable files—often the first step toward full site compromise.

Remediation

1. Upgrade UP to 6.1.0 or 5.2.1 (or newer).
2. Rotate DB passwords if exposure is suspected.
3. Block or rate-limit suspicious com_ajax UP requests at the WAF until patched.

Legal and ethical use

--read-probe attempts to read sensitive files on the target. Test only Joomla instances you own or have explicit written permission to assess.

References

• NVD — CVE-2026-97161
• GitHub PoC — murrez/CVE-2026-97161
• PoC — CVE-2026-97160 (UP code injection)