CVE-2026-57827

CriticalCVSS 9.8

Published: 11/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

Unauthenticated arbitrary file upload vulnerability in Joomla extension RSFiles (< 1.17.12) allowing full remote code execution.

Risk Assessment

An attacker can upload a malicious file and gain full control over the server, leading to data theft, content modification, or site takeover.

Recommendation

Update the RSFiles extension to version 1.17.12 or later.

Original NVD description (English source)

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.