CVE-2026-97163
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an unauthenticated remote code installation vulnerability. An attacker without authentication can cause malicious code to be installed in the application.
Risk Assessment
An unauthenticated attacker can remotely install arbitrary code, leading to full compromise of the Joomla site. The risk is critical because no credentials are required.
Recommendation
Update the UP extension to a version later than 6.0.29 (or 5.2.0 for the 5.x branch). If updating is not possible, consider disabling the extension.
Other vulnerabilities in Joomla UP plugin extension
See all- CVE-2026-97161High
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains various path traversal and file access vectors. An attacker can access files outside the intended directory.
- CVE-2026-97160High
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an authenticated, privileged PHP command injection vulnerability. An attacker with appropriate privileges can execute arbitrary PHP commands.
Original NVD description (English source)
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Vulnerability data from NVD (NIST) · CISA KEV · EPSS