Security
Joomla UP plugin fixes critical vulnerabilities
Joomla’s UP content plugin has fixed four vulnerabilities that could expose site files, enable code execution and permit database access.
mySites.guru published research into UP, the Universal Plugin for Joomla, after testing version 6.0.29. The maintainer released 6.1.0 for Joomla 5.2 through 6.x and 5.2.1 for Joomla 3.10 through 5.1. Versions from 5.0 through 6.0.29 are affected.
- An unauthenticated request could read files accessible to the web server, including
configuration.php. - An anonymous visitor could trigger an insecure GitHub download path that could lead to code execution if the transfer was intercepted.
- Article authors could bypass restrictions on PHP and SQL actions, exposing code execution and database access to page visitors.
- An unauthenticated request could create files outside the intended directory.
The issues are tracked as CVE-2026-97160 through CVE-2026-97163. The Joomla CNA assigned a maximum severity of Critical with a 10.0 score. mySites.guru confirmed the file-read and author-level execution issues on a test site and did not publish working attack requests.
Administrators should back up affected sites and update to the appropriate fixed release, then verify the installed version and review unfamiliar files, administrator accounts and article-author permissions.
Originally reported by mySites.guru.