CVE-2026-97163 — Joomla UP Plugin Unauthenticated GitHub Action Install

Overview

CVE-2026-97163 affects the UP (Universal Plugin) for Joomla (plg_content_up, lomart.fr). Versions 5.0.0–5.2.0 and 6.0.0–6.0.29 (especially the mini package without bundled actions) allow unauthenticated remote code installation: an anonymous request can start an on-demand download of action code from the maintainer’s GitHub repository into plugins/content/up/actions/, where Joomla executes it. The fetch ran with TLS certificate verification disabled, so a network-positioned attacker (MITM) could substitute a malicious archive (CWE-22, CWE-284). CVSS 4.0 10.0 Critical (PR:N). Fix: UP 6.1.0 / 5.2.1 (authentication restrictions + TLS verify restored). Assigner: Joomla CNA.

Research: mySites.guru — UP 6.1.0 security fixes

Related (same release): CVE-2026-97160 (PHP shortcode), CVE-2026-97161 (file read), CVE-2026-97162 (SQLi).

| | | |---|---| | Product | UP plugin (plg_content_up) | | Affected | 5.0.0–5.2.0, 6.0.0–6.0.29 | | Fixed | 5.2.1, 6.1.0 | | Vector | Mini mode: first use of an action → GitHub zip → unpack under plugin | | Impact | Integrity / RCE (with MITM or compromised fetch path) |

Open source PoC: https://github.com/murrez/CVE-2026-97163

The bundled tool fingerprints UP, checks vulnerable versions, and probes com_ajax patterns (or --ajax-url / --render-url from your lab). It does not perform MITM or host malicious archives.

Bundled tool (Python 3)

pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --install-probe
python poc.py -u https://joomla.example --mode exploit --install-probe --action slideshow-billboard
python poc.py -u https://joomla.example --mode exploit --render-url "https://joomla.example/index.php?option=com_content&view=article&id=99"
python poc.py -u https://joomla.example --mode exploit --ajax-url "https://joomla.example/index.php?option=com_ajax&group=content&plugin=up&..."
python poc.py --list targets.example.txt --mode check --install-probe -j 8

Post-patch: inspect plugins/content/up/actions/ for unknown PHP folders per vendor guidance.

Asset discovery

body="plugins/content/up"
body="plg_content_up" "up.lomart"

Impact

Unauthenticated triggering of remote action installation—combined with disabled TLS verification, hostile networks could deliver attacker-controlled PHP under the plugin tree.

Remediation

1. Upgrade UP to 6.1.0 or 5.2.1 immediately.
2. Audit plugins/content/up/actions/ for unexpected directories.
3. Prefer full UP packages over mini where policy allows; restrict outbound fetches from production Joomla hosts.

Legal and ethical use

Authorized testing only. Do not MITM or deploy malicious archives on third-party sites.

References

• NVD — CVE-2026-97163
• GitHub PoC — murrez/CVE-2026-97163