Vulnerability · Published Jul 11, 2026 · Assigned by Joomla
CVE-2026-57827Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
Critical 10.0
In plain English
A critical-severity unrestricted file upload in rsjoomla.com RSFiles extension for Joomla from rsjoomla.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rsjoomla.com | rsjoomla.com RSFiles extension for Joomla | 1.0-1.17.11 |
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red