Security
RSFiles! fixes critical unauthenticated upload flaw
RSJoomla has fixed a critical security flaw in RSFiles! for Joomla that could let unauthenticated visitors upload and execute PHP code on affected websites.
Research published by mySites.guru identifies the vulnerability as an unauthenticated file upload issue, classified as CWE-434 and tracked as CVE-2026-57827. The affected component is com_rsfiles, with versions through 1.17.11 vulnerable. RSJoomla addressed the issue in 1.17.12.
The flaw is rated critical because an attacker did not need an account to upload a PHP file to the component’s downloads directory and execute it. The advisory says no proof of concept has been made public. It does not report confirmed exploitation.
- Update every
RSFiles!installation to1.17.12or later immediately. - After updating, inspect affected sites for unexpected files and administrator accounts.
- Treat installations running
1.17.11or earlier as potentially exposed until checked.
Administrators should prioritise the update rather than wait for a routine maintenance window.
Originally reported by mySites.guru.