EUVD-2026-87780
GHSA-6pgc-8534-jjrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Joomla site with vulnerable UP plugin
-
DeliverySend crafted request with traversal path
-
ExploitBypass path validation
-
ExecutionInstall attacker-controlled code
-
PersistExecute code in Joomla/PHP context
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target Joomla site has the lomart.fr 'UP' plugin extension installed and active at an affected version (5.0.0-5.2.0 or 6.0.0-6.0.29); no authentication, user interaction, or non-default configuration is indicated (AV:N/AC:L/AT:N/PR:N/UI:N). The primary limiting factor is deployment scope - this is a niche, single-developer Joomla add-on, so exposure depends entirely on whether the specific plugin is present, not on default Joomla installs. |
| Impact | This is a genuine top-tier priority on the technical merits: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no authentication, no user interaction, and no special attack requirements, with High impact on confidentiality, integrity, and availability of both the vulnerable system and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) - hence the 10.0. 'Unauthenticated remote code installation' via a CWE-22 path traversal is effectively a full-compromise RCE class of bug. However, the corroborating exploitation signals are ALL absent: no EPSS score provided, no CISA KEV listing, and no public POC identified - so there is no evidence of active or automatable exploitation at this time, only high theoretical severity. The intelligence is also thin: the single reference is the vendor product homepage (https://up.lomart.fr/), with no formal advisory, GHSA, NVD analysis, or confirmed patched version, and the affected version ranges appear to come from the CVE title alone. Net: treat as HIGH severity where the extension is deployed, but the real-world exploitation probability is unquantified and the product footprint is narrow. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a Joomla site running the vulnerable lomart.fr 'UP' plugin, abusing insufficient path validation to write/install attacker-controlled code outside the intended directory. Because the flaw permits 'remote code installation,' the planted code executes in the Joomla/PHP context, yielding site takeover. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Unauthenticated remote code installation in the lomart.fr 'UP' plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows remote attackers to write and install arbitrary code on affected sites without authentication, user interaction, or non-default configuration, as reflected in the vendor's CVSS 4.0 base score of 10.0. The flaw is a path traversal (CWE-22) that lets attacker-supplied paths escape the intended directory and place executable content where the web server will run it, giving full compromise of confidentiality, integrity, and availability on the host and follow-on systems. This is a niche, single-vendor Joomla add-on, so exposure depends entirely on whether the plugin is installed and active; no public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
RemediationAI
No vendor-released patch was identified at time of analysis, so the immediate priority is containment: inventory Joomla instances and, where the lomart.fr UP plugin is installed at 5.0.0-5.2.0 or 6.0.0-6.0.29, disable it through Joomla's Extensions > Manage > Manage panel and then fully uninstall it if it is not business-critical - disabling alone still leaves files on disk, so uninstall or move the extension directory out of the web root for a stronger guarantee. Check the vendor project site https://up.lomart.fr/ directly for a patched release before restoring functionality. Where the plugin cannot be removed, put compensating controls in front of it: block requests containing traversal sequences or encoded equivalents (../, ..%2f, %2e%2e%2f) with WAF or reverse-proxy rules, restrict access to the extension's endpoints to trusted source addresses, and deploy file-integrity monitoring on the web root to detect newly written PHP files; each of these carries trade-offs - WAF rules can be bypassed by encoding variants and may break legitimate plugin traffic, IP allowlisting prevents any external access to the plugin's features, and file monitoring is detective rather than preventive, so it alerts after a successful write. As general hardening, ensure the web server user cannot write to directories it does not need, remove write permission from PHP-executable paths where feasible, and review the site for web shells or unexpected files, particularly if the plugin has been exposed to untrusted networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in the lomart.fr UP plugin, a third-party Joomla extension. Joomla extensions execute with the full privilege of the PHP process under the site's web root, so a traversal primitive that permits writing files outside the intended upload/working directory can typically be chained into code installation by dropping a PHP file into a web-accessible location - matching the 'Unauthenticated remote code installation' characterization and the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA:H and SC/SI/SA:H. The CPE cpe:2.3:a:lomart.fr:up_plugin_for_joomla:*:*:*:*:*:*:*:* identifies the affected component, and the affected version windows are 5.0.0-5.2.0 and 6.0.0-6.0.29. Because the vulnerable surface is reachable through normal HTTP requests with PR:N, exploitation does not require a Joomla account or elevated privileges; the practical constraint is deployment scope, since this plugin is not part of a default Joomla installation.
Know when Up Plugin For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Unauthenticated network path traversal enabling code installation gives AV:N/AC:L/PR:N/UI:N with full C/I/A loss; scored S:U as impact is within the vulnerable Joomla/PHP component.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
Executive ViewAI
Organizations running the lomart.fr 'UP' extension on Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) are exposed to a maximum-severity path-traversal flaw that allows a remote attacker to place and execute arbitrary code on the web server, carrying a vendor CVSS score of 10.0 and no vendor-released patch identified at time of analysis. Exposure is limited to sites where this niche, single-vendor add-on is installed and active, but for those sites the impact is total: full loss of confidentiality, integrity and availability on the host, plus potential follow-on compromise of connected systems. Leadership should treat every Joomla property running this plugin as a top-priority containment item, because the absence of a patch means only removal or isolation reduces risk.
No vendor-released patch identified at time of analysis. Interim mitigations: disable and uninstall the lomart.fr 'UP' plugin (all versions 5.0.0-5.2.0 and 6.0.0-6.0.29), or take affected sites offline if the plugin cannot be removed; block traversal-style requests to the plugin's directories at the WAF or reverse proxy; restrict web server write permissions and deploy file-integrity monitoring; review logs and filesystems for unauthorized code; and apply the vendor patch as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Up Plugin For Joomla
View allAuthenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a
Unauthenticated path traversal in the lomart.fr UP extension for Joomla (versions 5.0.0 through 5.2.0 and 6.0.0 through
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 thr
Exploit-DB