EUVD-2026-87781
GHSA-4qjx-g3m9-jcwf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Joomla site running UP plugin
-
DeliverySend traversal-encoded file-access request
-
ExploitBypass path restrictions to read configuration.php
-
ExecutionHarvest DB credentials and secrets
-
ImpactPivot to database/backend compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target Joomla site has the lomart.fr UP plugin installed and enabled at an affected version (5.0.0-5.2.0 or 6.0.0-6.0.29), and that a vulnerable file-access/download vector of the plugin is reachable over HTTP. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and default configurations appear exploitable. The primary limiting factor is deployment scope - this is a niche third-party extension, so exposure depends on the specific plugin being present rather than on any special server configuration. |
| Impact | This is a classic high-CVSS-but-moderate-real-risk case. The vendor (via Joomla VEL) assigns CVSS 4.0 base 9.2 driven by AV:N/AC:L/PR:N/UI:N plus VC:H and SC:H (subsequent-system confidentiality). I disagree with the 9.2: the flaw is arbitrary file READ via path traversal (CWE-22) with no integrity or availability impact, and the SC:H scope-change to a subsequent system is not clearly justified for a read-only web-app disclosure - my independent CVSS 3.1 estimate is ~7.5 (C:H/I:N/A:N, S:U). The unauthenticated network vector is the genuinely serious element: an attacker can read configuration.php to harvest Joomla DB credentials and secrets, which can be pivoted into deeper compromise. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no evidence of active or automated exploitation - treat this as latent risk, not an active incident. No signals conflict on the network-vector claim; the main tension is vendor severity inflation for a confidentiality-only bug. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to a vulnerable UP plugin file-access endpoint using directory-traversal sequences to escape the intended directory. They retrieve Joomla's configuration.php, exposing database credentials and secret keys, then reuse those to access the backend database or forge sessions. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Unauthenticated path traversal in the lomart.fr UP extension for Joomla (versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29) allows remote attackers to read files outside the intended plugin directory, exposing configuration files, credentials and other sensitive data under the web root's readable filesystem. The reported CVSS 4.0 score is 9.2, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a confidentiality-only impact with no authentication or user interaction required, while integrity and availability remain unaffected. Real-world risk is governed by deployment scope rather than exploitability: this is a niche third-party Joomla extension, no public exploit was identified at time of analysis, and only sites that have the plugin installed and enabled at an affected version are exposed.
RemediationAI
No vendor-released patch is identified in the available intelligence, and the only reference provided is the vendor site https://up.lomart.fr/, which should be checked directly for a fixed release, an updated affected-version list or an official advisory - treat any build newer than 6.0.29 or 5.2.0 as potentially fixed only once the vendor confirms it. Until a fix is confirmed, the most effective action is to disable or uninstall the UP plugin if it is not business-critical; the trade-off is complete loss of whatever front-end or administrative functionality the extension provides. If the plugin must remain active, restrict access to its endpoints at the reverse proxy or WAF by blocking requests whose parameters contain traversal patterns (../, ..\, and encoded equivalents such as %2e%2e%2f, %252e%252e%252f, and absolute-path forms), while recognizing that signature-based filtering of traversal is bypassable via alternative encodings, so it should be combined with other controls. Additional compensating measures include tightening filesystem permissions so the web server user cannot read files outside the Joomla web root (a change that can break legitimate plugin operations), moving sensitive files such as configuration.php backups, credential files and archives out of readable web-accessible paths, and enabling logging and alerting for anomalous file-read patterns or requests containing traversal sequences against Joomla component URLs. Given the confidentiality-only impact, watch for follow-on use of any disclosed credentials or configuration secrets.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a third-party Joomla CMS extension, the UP plugin from lomart.fr, implemented in PHP and running inside the Joomla application context. The flaw is a classic CWE-22 improper limitation of a pathname to a restricted directory: file-access or file-download parameters handled by the plugin are not sufficiently normalized or constrained, so traversal sequences (such as ../ or encoded variants like %2e%2e%2f, and potentially double-encoded or absolute-path forms) can escape the plugin's intended directory and resolve to arbitrary readable files on the host, including Joomla configuration.php, credential stores, logs and backups. The CPE entry cpe:2.3:a:lomart.fr:up_plugin_for_joomla:*:*:*:*:*:*:*:* uses a wildcard version, indicating the vendor namespace is affected generally while the vendor-reported vulnerable ranges are 5.0.0-5.2.0 and 6.0.0-6.0.29. Because the request path is processed by the Joomla component/router before the plugin's own logic, exploitation typically requires only that the relevant plugin endpoint be reachable over HTTP; the assessed vector (PR:N/UI:N) indicates no credentials or user interaction are needed and default configurations appear exploitable. The impact profile (VC:H with VI:N/VA:N) is consistent with an information-disclosure primitive rather than code execution or data modification.
Know when Up Plugin For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Unauthenticated remote path traversal enabling read of sensitive config files gives C:H, but there is no write/execution or availability impact (I:N/A:N) and no clear scope change (S:U).
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Executive ViewAI
A critical-severity flaw in the lomart.fr UP extension for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows an unauthenticated remote attacker to read files outside the plugin directory, potentially exposing configuration files and stored credentials. Because the affected component is a niche third-party extension, exposure is limited to websites that have it installed and enabled - but any organization hosting such a site should treat its secrets as potentially compromised. With no vendor patch and no public exploit identified at time of analysis, leadership should prioritize inventorying affected sites and containing credential exposure rather than emergency remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or uninstall the lomart.fr UP extension where it is not operationally required; where it must remain, block traversal-style requests at the WAF or reverse proxy, restrict site access to trusted networks or authenticated users, tighten file permissions so configuration files are not readable by the web server user, and rotate all credentials and secrets stored under the web root since confidentiality of those files can no longer be assumed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Up Plugin For Joomla
View allUnauthenticated remote code installation in the lomart.fr 'UP' plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29)
Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 thr
Exploit-DB