CVE-2026-97163

The lomart.fr UP plugin for Joomla, in versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, allows unauthenticated remote code installation. The flaw is tied to path traversal (CWE-22) and improper access control (CWE-284), and it can be triggered over the network with no login and no user interaction. A successful attack can fully compromise confidentiality, integrity, and availability of the site and of subsequent systems, reflected in a CVSS 4.0 score of 10.0. Joomla sites running those UP plugin versions are affected. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Update the lomart.fr UP Joomla plugin to a vendor release outside the affected ranges (later than 5.2.0 on the 5.x line, or later than 6.0.29 on the 6.x line). If no patched build is available, disable or uninstall the extension and restrict public access to the site until it is. Review the site for unexpected extensions, files, or admin accounts added while a vulnerable version was exposed.