Python 3 PoC for **[CVE-2026-97160]( — **UP (Universal Plugin)** for Joomla ([lomart.fr / up.lomart.fr](
**CVE-2026-97160** — **UP plugin 5.0.0–5.2.0** and **6.0.0–6.0.29** allow **PHP code injection** through `{up php=...}` shortcodes processed with **`eval()`** (CWE-94). CNA classifies this as **authenticated / high privilege**; before **6.1.0** / **5.2.1**, **article authors** could bypass reserved-action checks via **save vs render name normalization**, so PHP in an article ran for **every visitor**. CVSS 4.0 **9.4 Critical**. **Fix:** UP **6.1.0** (Joomla 5.2+) or **5.2.1** (Joomla 3.10–5.1).
Related (same release): CVE-2026-97161 (file read / traversal), CVE-2026-97162 (SQLi), CVE-2026-97163 (GitHub mini-install).
**PoC page:** [
Catalog: [
| **Product** | UP plugin for Joomla (`plg_content_up`) |
| **Affected** | **5.0.0–5.2.0**, **6.0.0–6.0.29** |
| **Vector** | Article/module shortcode `{up php=...}` |
python poc.py -u --mode check
python poc.py -u --mode check --article-url "
python poc.py -u --mode exploit --article-url "
python poc.py --list targets.example.txt --mode check -j 10
**Lab:** As admin (or author on vulnerable builds), add to article body:
Publish, then run `--mode exploit --article-url `.
CVE-2026-97160 PoC: Joomla **UP (lomart.fr)** ≤6.0.29 / ≤5.2.0 — privileged `{up php=}` shortcode **eval** code injection (author bypass on older builds). [PoCbit](
**CVE-2026-97160:** Joomla **UP** eklentisinde `{up php=...}` ile sunucuda PHP çalıştırma; **6.1.0** / **5.2.1** ile düzeltildi.
Authorized testing only. Do not publish malicious shortcodes on sites you do not own.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
