Read the docs
TI-2026-63952 Aliases CVE-2026-97160GHSA-4h74-hj22-v78v

Code injection in lomart.fr UP plugin for Joomla

Priority MEDIUM 45CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0131 70th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lomart.frUP plugin for Joomla5.0.0-5.2.0; 6.0.0-6.0.29—No fix listedCNA
  • UP plugin for Joomla Vendorlomart.fr Affected 5.0.0-5.2.0; 6.0.0-6.0.29 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\!:*:*5.0.0 – 5.2.0; 6.0.0 – 6.0.29Vulnerablelomart.fr
  • cpe:2.3:a:lomart:up:*:*:*:*:*:joomla\!:*:* Versions 5.0.0 – 5.2.0; 6.0.0 – 6.0.29 Vulnerable ·lomart.fr

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-97160
  2. 2026-10-03 Alias added: GHSA-4h74-hj22-v78v
  3. 2026-10-21 CVSS score added · NVD

References

Other 1

  • TI-2026-63955 Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 CVSS 4.0CRITICAL 10.0
  • TI-2026-63953 Path traversal in lomart.fr UP plugin for Joomla CVSS 4.0CRITICAL 9.2
  • TI-2026-63954 Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 CVSS 4.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences