CVE-2026-97161
CriticalCVSS 9.2Summary
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains various path traversal and file access vectors. An attacker can access files outside the intended directory.
Risk Assessment
An attacker may read or access unauthorized files on the server, potentially leading to data leakage or further escalation. The risk is high for sites with this extension installed.
Recommendation
Update the UP extension to a version later than 6.0.29 (or 5.2.0 for the 5.x branch). If updating is not possible, consider disabling the extension.
Other vulnerabilities in Joomla UP plugin extension
See all- CVE-2026-97163Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an unauthenticated remote code installation vulnerability. An attacker without authentication can cause malicious code to be installed in the application.
- CVE-2026-97160Critical
The Joomla UP plugin extension (lomart.fr) in versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains an authenticated, privileged PHP command injection vulnerability. An attacker with appropriate privileges can execute arbitrary PHP commands.
Original NVD description (English source)
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Vulnerability data from NVD (NIST) · CISA KEV · EPSS