Which versions of RSFiles are affected by EUVD-2026-43168?

A critical remote code execution vulnerability in the RSFiles extension (Joomla) enables unauthenticated attackers to upload and execute arbitrary code on hosting servers, allowing complete site and…

Is there a public PoC exploit available for EUVD-2026-43168?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43168. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-43168?

Within 24 hours: Identify all Joomla installations using RSFiles extension; document affected systems and data criticality. Within 7 days: Disable or uninstall RSFiles extension; implement Web Application Firewall (WAF) rules blocking POST requests to /index.php?option=com_rsfiles upload endpoints; enable file integrity monitoring on upload directories. Within 30 days: Evaluate and migrate to alternative Joomla download managers with active security support; monitor RSJoomla advisory channels for patch availability or vendor guidance.

RSFiles EUVD-2026-43168

Q: What is the CVSS score of EUVD-2026-43168?

EUVD-2026-43168 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.3%.

| CVE-2026-57827 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-11 Joomla

GHSA-7q98-wg4p-5v7g

File Upload Rsjoomla Com Rsfiles Extension For Joomla

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

vuln.today AI

10.0 CRITICAL

Unauthenticated network file upload yielding code execution beyond the Joomla component onto the host justifies AV:N/AC:L/PR:N/UI:N with S:C and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 10:17 vuln.today

CVE Published

Jul 11, 2026 - 09:29 cve.org

CRITICAL 10.0

DescriptionCVE.org

The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

AnalysisAI

Unauthenticated arbitrary file upload in the RSFiles download-manager extension for Joomla (by RSJoomla) lets remote attackers upload executable files (e.g. PHP web shells) and achieve full remote code execution on the hosting server. The CVSS 4.0 threat metrics flag exploitation as active (E:A) and automatable (AU:Y), and NVD/ADP assigns maximum urgency, but no CISA KEV listing was provided in this data. A vendor product page and a third-party technical writeup are referenced; standalone public exploit code was not confirmed in the supplied sources.

Technical ContextAI

The affected component is the RSFiles extension (cpe:2.3:a:rsjoomla.com:rsjoomla.com_rsfiles_extension_for_joomla), a commercial file/download manager add-on for the Joomla CMS. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the upload handler fails to properly validate or restrict the type/extension of files it accepts, allowing server-executable content (such as .php) to be written into a web-accessible location. Because Joomla runs on PHP, an uploaded PHP file placed under the web root executes with the privileges of the web server process, converting a file-write primitive into arbitrary code execution.

RemediationAI

No vendor-released patch version was identified at time of analysis, and the supplied CPE gives no fixed version, so administrators should immediately check RSJoomla (https://www.rsjoomla.com/joomla-extensions/joomla-download-manager.html) for an updated RSFiles release and apply the latest version as the primary fix. As compensating controls until a confirmed patch is applied: restrict or block access to the RSFiles upload endpoint at the web server or WAF layer (this may break legitimate front-end uploads); configure the web/PHP server to deny execution of scripts in RSFiles upload directories (e.g. disable PHP handlers via .htaccess/nginx location rules in the upload path - side effect: none for static downloads but must be tested); enforce a server-side allowlist of permitted extensions/MIME types if configurable; and monitor upload directories for newly written .php/.phtml or other executable files. Review the writeup at https://mysites.guru/blog/rsfiles-unauthenticated-file-upload-rce/ for endpoint specifics, and audit existing uploads for planted web shells.