mohammad-008/rsfiles-cve-2026-57827Unauthenticated File Upload → RCE PoC for CVE-2026-57827 (RSFiles! Joomla < 1.17.12). Authorized security research use only.
Disclaimer — authorized use only. This is a proof-of-concept for security research and defensive testing. You are responsible for using it only on systems you own or have explicit written permission to test. Misuse against third parties without consent is illegal. See SECURITY.md for the responsible-disclosure stance.
Exploit + standalone detector for CVE-2026-57827 in the RSFiles!
(com_rsfiles) component for Joomla, versions < 1.17.12 (fixed in
1.17.12, CVSS 9.8 / 10.0).
The frontend upload is split across two tasks:
rsfiles.checkupload — pre-flight gate (permission + extension allow-list)rsfiles.upload — write method (no permission check, no file-type check, no CSRF)The write task can be called directly, skipping the pre-flight gate, which
lets an unauthenticated attacker upload an executable .php file into a public
folder and run it → .
| File | Purpose |
|---|---|
cve_2026_57827.py | Exploit + scanner + CLI (entry point) |
rsfiles_detect.py | Standalone detection module (no exploit) — also has its own CLI |
payload.py | Modular, compact PHP payload builder |
common.py | Shared HTTP client, config, and helpers |
mock_server.py | Safe local simulation for testing |
All modules must live in the same directory (they import each other).
python3 -m pip install -r requirements.txt # or just: pip install requests
python rsfiles_detect.py -t example.com
Host : example.com
RSFiles! : YES v1.17.11
Protocol : https
Status : VULNERABLE (below 1.17.12)
Multi-host:
python rsfiles_detect.py -f hosts.txt
python cve_2026_57827.py -t example.com
On success the tool prints the shell URL with its random token and the command output — that output is the proof of RCE.
python cve_2026_57827.py -f targets.txt --threads 30 -o shells.txt --csv report.csv
| Flag | Description |
|---|---|
--threads N | Concurrency (default 30) |
--proxy URL | Route through a proxy (Burp/ZAP) |
--timeout N | Per-request timeout (seconds) |
--no-cleanup | Keep the uploaded shell (default: auto-delete after RCE) |
-o FILE | Save RCE URLs |
--csv FILE | Full structured report |
--debug / -v | Verbose request-level logging |
# Terminal 1 — start the mock (vulnerable)
python mock_server.py 8000 1.17.11
# Terminal 2 — scan it
python rsfiles_detect.py -t 127.0.0.1:8000
python cve_2026_57827.py -t 127.0.0.1:8000
1.17.11 / 1.17.10 = vulnerable · 1.17.12 = patched.
payload.py): each behaviour (gate, upload, exec,
delete, list) is one small function; exec-function names are base64-encoded
so raw names like system don't appear in the file bytes.cache7f31.php) instead of classic
hidden dotfile shell names.common.base_of().Style modelled on public Joomla component-exploit collections (e.g.
incredibleindishell/joomla-vulnerabilities) and the RSJoomla/mysites.guru
advisory write-ups for this CVE.
MIT — see LICENSE. Research/defense use only.