Python 3 PoC for **[CVE-2026-97161]( — **UP (Universal Plugin)** for Joomla ([lomart.fr](
**CVE-2026-97161** — **UP 5.0.0–5.2.0** and **6.0.0–6.0.29** expose **unauthenticated path traversal / arbitrary file read** (CWE-22, CWE-284) through **AJAX file-access** handlers (notably **ajax-view** popup loader). Attackers could read **`configuration.php`** and other server-readable files. CVSS 4.0 **9.2 Critical** (`PR:N`). **Fix:** UP **6.1.0** / **5.2.1**.
Same release also fixed arbitrary **file creation** outside intended directories (same CVE family).
**PoC page:** [
Catalog: [
| **Product** | UP plugin (`plg_content_up`) |
| **Affected** | **5.0.0–5.2.0**, **6.0.0–6.0.29** |
| **Vector** | `com_ajax` + UP plugin — user-controlled file path to ajax-view backend |
| **Impact** | Confidentiality (DB creds via `configuration.php`) |
Vendor did not publish exact query strings; this PoC **fingerprints UP**, probes common **`com_ajax`** parameter shapes, or uses **`--ajax-url`** from your lab capture.
python poc.py -u --mode check
python poc.py -u --mode check --read-probe
python poc.py -u --mode exploit --read-probe
python poc.py -u --mode exploit --ajax-url "
python poc.py --list targets.example.txt --mode check --read-probe -j 8
CVE-2026-97161 PoC: Joomla **UP (lomart.fr)** unauth **path traversal / file read** via ajax-view (≤6.0.29). Detects plugin, probes `configuration.php`. [PoCbit](
**CVE-2026-97161:** UP eklentisinde oturumsuz **dosya okuma** (path traversal); **6.1.0** / **5.2.1** ile giderildi.
Authorized testing only. `--read-probe` attempts to read sensitive files on the target.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
