CVE-2026-57827: critical vulnerability in rsjoomla.com RSFiles extension for Joomla
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 10epss 2.3%
from disclosure to weapon18 days
Published on NVDJul 11
1st PoC+18d
Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
Affected products
rsjoomla.com · rsjoomla.com RSFiles extension for Joomlapublic PoCs found — 4
githubgithub.com/shinthink/CVE-2026-57827★ 16githubgithub.com/Mohammad-008/rsfiles-CVE-2026-57827★ 9githubgithub.com/jjkk123123/CVE-2026-57827★ 1githubgithub.com/Candisexterior171/CVE-2026-57827★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.