Alex Joseph
A significant security flaw has been identified in the lomart.fr UP plugin for Joomla!, labeled as CVE-2026-97161. This vulnerability, categorized as a path traversal and file access issue, could allow attackers to gain unauthorized access to sensitive files on a Joomla! website. Understanding this risk is crucial for anyone managing a Joomla! installation, especially those utilizing the affected plugin.
What is Path Traversal?
Path traversal, also known as directory traversal, is a web security vulnerability that enables an attacker to read arbitrary files on a server running a vulnerable application. It works by manipulating file paths to access directories and files outside of the intended web root. Imagine an attacker tricking your website into showing them files from your system, like configuration files or user data, that they should never see. This vulnerability in the lomart.fr UP plugin opens the door to such unauthorized access, posing a serious threat to the integrity and confidentiality of your website’s data.
CVE Details
This vulnerability impacts the lomart.fr UP plugin, an extension designed for Joomla! content management systems. Its official details are as follows:
- Product: lomart.fr UP plugin for Joomla!
- CVE ID: CVE-2026-97161
- Published Date: September 26, 2026
- Severity: High
- CVSS Score: 7.5
- Status: Analyzed
Affected Products
The path traversal and file access vulnerability specifically targets versions of the lomart.fr UP plugin. If your Joomla! website uses this extension, it is imperative to check your installed version. The affected versions include:
- lomart.fr UP plugin versions 5.0.0 through 5.2.0 (inclusive)
- lomart.fr UP plugin versions 6.0.0 through 6.0.29 (inclusive)
Users running any of these versions are at risk and should take immediate action to protect their sites.
Current Status
The vulnerability has been officially analyzed. While specific patch details for the path traversal issue weren’t explicitly detailed on the vendor’s primary information page at the time of this writing, recent updates for the UP plugin have been released. These updates, such as versions 6.1.8, 6.1.11, and 6.1.13, were published shortly after the CVE was made public. It is standard practice for such updates to include crucial security fixes, addressing reported vulnerabilities to enhance the overall security posture of the software.
Severity Level
Rated as “High” severity with a CVSS score of 7.5, this vulnerability should not be taken lightly. A high severity rating indicates that exploiting this flaw could lead to significant unauthorized access to system files, potentially exposing sensitive information, allowing attackers to modify or delete data, or even take full control of the affected Joomla! website. Such a compromise can have severe repercussions, including data breaches, reputation damage, and operational disruption.
Possible Solutions
Protecting your Joomla! website from this path traversal vulnerability requires prompt action. Here are the recommended steps:
- Update Immediately: The most critical step is to update your lomart.fr UP plugin to the latest stable version. Based on recent activity, versions 6.1.13 and newer are available. Always download updates from the official lomart.fr website to ensure you are getting legitimate and secure software.
- Regular Backups: Maintain a routine of regular backups for your entire Joomla! installation. In the event of a security incident, a recent backup can be invaluable for restoring your site to a safe state.
- Web Application Firewall (WAF): Deploying a robust Web Application Firewall can help detect and block attempts to exploit path traversal and other common web vulnerabilities.
- Monitor Logs: Regularly check your server and Joomla! logs for any suspicious activity or unauthorized file access attempts.
- Joomla! Core Updates: Ensure your Joomla! core system is always up-to-date. Running outdated software increases your overall attack surface. (See also: Securing Your Joomla Website)
References
https://up.lomart.fr/
