CVE-2026-97160
CriticalCVSS 9.4Summary
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an authenticated, privileged PHP command injection vulnerability. An attacker with appropriate privileges can execute arbitrary PHP commands.
Risk Assessment
An authenticated privileged user can execute arbitrary PHP code, leading to application compromise. The risk is high, especially if privileges are broadly granted.
Recommendation
Update the UP extension to a version later than 6.0.29 (or 5.2.0 for the 5.x branch). Restrict granting privileges to the extension.
Other vulnerabilities in Joomla UP plugin extension
See all- CVE-2026-97163Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an unauthenticated remote code installation vulnerability. An attacker without authentication can cause malicious code to be installed in the application.
- CVE-2026-97161Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains various path traversal and file access vectors. An attacker can access files outside the intended directory.
Original NVD description (English source)
Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Vulnerability data from NVD (NIST) · CISA KEV · EPSS