# CVE-2026-97163

Unauthenticated remote code installation in Joomla UP plugin (critical RCE).

- Page: https://www.vulneraibility.com/cve/CVE-2026-97163
- CVSS: 10.0
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.47% (percentile 40.8)
- Unvetted proof-of-concept code on GitHub: 2 GitHub proofs of concept (first 2026-09-26)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-26)
- Weakness: CWE-22, CWE-284
- Published: 2026-09-26

## Affected versions

- lomart.fr UP plugin for Joomla: affected 5.0.0-5.2.0; 6.0.0-6.0.29

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated remote code installation allowing full site compromise, remote code execution, backdoors and data theft.

## Action

Immediate action required

## Recommendation

Remove/disable UP plugin, apply vendor patch when released, audit for backdoors and restore from clean backups.

## References

- [other] https://up.lomart.fr/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.