Python 3 PoC for **[CVE-2026-97163]( — **UP (Universal Plugin)** for Joomla ([lomart.fr](
**CVE-2026-97163** — **UP 5.0.0–5.2.0** and **6.0.0–6.0.29** (especially the **mini** package without bundled actions) allow **unauthenticated remote code installation**: an anonymous request can start an **on-demand download** of action code from the maintainer’s **GitHub** repository into `plugins/content/up/actions/`, where Joomla executes it. The fetch ran with **TLS certificate verification disabled**, so a **network-positioned attacker (MITM)** could substitute a malicious archive (CWE-22, CWE-284). CVSS 4.0 **10.0 Critical** (`PR:N`). **Fix:** UP **6.1.0** / **5.2.1** (auth restrictions + TLS verify restored).
Research: [mySites.guru — UP 6.1.0 security fixes](
Related (same release): [CVE-2026-97160](../CVE-2026-97160/) (PHP shortcode), [CVE-2026-97161](../CVE-2026-97161/) (file read), CVE-2026-97162 (SQLi).
**PoC page:** [
Catalog: [
| **Product** | UP plugin (`plg_content_up`) |
| **Affected** | **5.0.0–5.2.0**, **6.0.0–6.0.29** |
| **Vector** | Mini mode: first use of an action → GitHub zip → unpack under plugin |
| **Impact** | Integrity / RCE (with MITM or compromised fetch path) |
This PoC **fingerprints UP**, checks vulnerable versions, and **probes** `com_ajax` patterns (or **`--ajax-url` / `--render-url`** from your lab). It does not perform MITM or host malicious archives.
python poc.py -u --mode check
python poc.py -u --mode check --install-probe
python poc.py -u --mode exploit --install-probe --action slideshow-billboard
python poc.py -u --mode exploit --render-url "
python poc.py -u --mode exploit --ajax-url "
python poc.py --list targets.example.txt --mode check --install-probe -j 8
**Post-patch:** inspect `plugins/content/up/actions/` for unknown PHP folders ([vendor guidance](
CVE-2026-97163 PoC: Joomla **UP (lomart.fr)** unauth **GitHub mini-install** / remote action deployment (≤6.0.29). Version detect + com_ajax install probes. [PoCbit](
**CVE-2026-97163:** UP **mini** paketinde oturumsuz **GitHub’tan action indirme** tetiklenebiliyor; TLS doğrulama kapalı olduğu için **MITM** ile kötü arşiv enjekte edilebilir. **6.1.0** / **5.2.1** yamalar.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
