Unauthenticated Arbitrary File Upload in Joomla RSFiles

This repository is a small standalone Python exploit for CVE-2026-57827 targeting the Joomla RSFiles! component. It contains one code file, CVE-2026-57827.py, and a minimal README. The script uses the requests library to send an unauthenticated multipart POST request to the RSFiles! upload handler at /index.php?option=com_rsfiles&task=rsfiles.upload, with overwrite enabled. After attempting upload, it verifies success by requesting the uploaded filename from several likely public storage locations: /downloads/, /briefcase/, /components/com_rsfiles/downloads/, and /images/rsfiles/. The tool supports two modes: a detection mode that uploads a benign test file named 123.php containing '123' and confirms retrieval, and an exploit mode that uploads any local file specified by the operator. Because the uploaded content is fully attacker-controlled, the exploit can be used to place a PHP payload or webshell if the server executes uploaded scripts, making this an operational arbitrary file upload exploit with potential RCE impact. The code disables TLS certificate warnings and accepts targets with or without an explicit URL scheme, defaulting to http:// if omitted.

This repository is a Python proof-of-concept exploit suite for CVE-2026-57827 affecting the RSFiles! Joomla component (com_rsfiles) before 1.17.12. The main exploit is cve_2026_57827.py, which combines detection, exploitation, multithreaded scanning, reporting, and optional cleanup. It targets a split-controller flaw where the public write task rsfiles.upload can be called directly without the permission, file-type, or CSRF checks enforced by rsfiles.checkupload, enabling unauthenticated PHP file upload and subsequent remote code execution. Repository structure is modular: common.py provides shared configuration, HTTP session handling, URL normalization, randomized user agents, and result dataclasses; rsfiles_detect.py is a standalone detector that probes known RSFiles component paths and extracts version information from XML manifests; cve_2026_57827.py orchestrates target loading, detection, upload, shell probing, command execution, and output/CSV generation; mock_server.py is a safe localhost-only simulator of a vulnerable RSFiles deployment; payload.py appears to be incorrectly duplicated with mock_server.py content in the provided snapshot, but README indicates it is intended to generate the PHP shell payload and randomized filenames. Exploit capability: the tool first detects RSFiles presence and version, then POSTs a multipart file upload to /index.php?option=com_rsfiles&task=rsfiles.upload with a randomized PHP filename and shell content. It then probes likely public storage paths such as /downloads/, /briefcase/, /components/com_rsfiles/downloads/, and /images/rsfiles/ to find the uploaded file. Once found, it verifies execution using a random token embedded in the shell, runs a command to prove RCE, records the shell URL, and optionally deletes the shell. The CLI supports single-target and file-based mass targeting, concurrency, proxying, timeout control, verbose logging, and report export. The included detector is not merely a scanner for generic Joomla; it specifically fingerprints RSFiles via component files like /components/com_rsfiles/rsfiles.php, /components/com_rsfiles/rsfiles.xml, /administrator/components/com_rsfiles/rsfiles.xml, and /media/com_rsfiles/css/rsfiles.css, then compares the discovered version against the patched release 1.17.12. Overall, this is a real exploit repository with both offensive upload/RCE functionality and a safer detection-only mode.

Repository contains a single Python exploit script, a README, license, and .gitignore. The main file, cve_2026_57827.py, is a standalone operational exploit for CVE-2026-57827 affecting RSJoomla's RSFiles! Joomla component before 1.17.12. The exploit targets a split-controller flaw where the guarded pre-flight task (rsfiles.checkupload) can be bypassed by directly invoking the unguarded write task at /index.php?option=com_rsfiles&task=rsfiles.upload. The script is not just a detector: it attempts end-to-end exploitation. Based on the visible code and README, it generates a randomized token and PHP payload, uploads a PHP file using the RSFiles file field name (file), then accesses the uploaded shell from the RSFiles downloads directory to verify command execution. The embedded PHP payload is more than a minimal command runner: it provides a token-protected web shell with command execution, file upload, file deletion, and directory listing capabilities. This makes the repository operational rather than a simple proof-of-concept. Repository structure is minimal and purpose-built: - README.md: detailed vulnerability explanation, attack flow, usage examples, manual exploitation steps, mitigation notes, and references. - cve_2026_57827.py: standalone exploit/scanner with CLI options for single-target and mass-target operation. - LICENSE and .gitignore: standard project metadata. The Python script appears to support both single-host exploitation and concurrent mass scanning via a target file and thread pool. It uses requests/urllib3, disables TLS warnings, randomizes User-Agent strings, and includes options such as --threads, --output, --debug, --verbose, and --no-cleanup. Output files mentioned in the repository include shells.txt, results.txt, and rs.txt. The exploit’s intended result is unauthenticated arbitrary file upload followed by remote code execution as the web server user, typically via a shell placed under /downloads/ and then invoked over HTTP.

This repository is a small standalone Python exploit for CVE-2026-57827, targeting the RSJoomla RSFiles! Joomla component before version 1.17.12. The repo contains one code file (cve_2026_57827.py), a README with vulnerability background and usage examples, plus standard license and gitignore files. The exploit is not part of a larger framework. Its purpose is to automate unauthenticated arbitrary file upload to the RSFiles! frontend upload task and then trigger remote code execution through an uploaded PHP shell. Based on the visible code and README, the script supports both single-target and mass-target modes, multithreading, optional output logging, debug/verbose modes, and optional cleanup of dropped shells. Core exploit flow: it targets the Joomla frontend endpoint /index.php?option=com_rsfiles&task=rsfiles.upload, which the vulnerability description says can be called directly without authentication, CSRF protection, or file-type validation. The script generates a tokenized PHP shell payload, uploads it using multipart form data with the file field name file, and then accesses the resulting shell from a web-accessible directory such as /downloads/. The shell itself is more than a minimal command runner: it supports command execution via GET parameter c, file upload via multipart field f, optional rename via POST parameter n, file deletion via GET parameter del, and directory listing in the shell directory. The shell enforces a simple shared-secret token through the t parameter and returns 404 if the token is absent or incorrect. Fingerprintable target artifacts include the vulnerable upload endpoint, the bypassed checkupload endpoint, and expected writable/executable directories such as /downloads/ and /briefcase/. The README also references the target-side Joomla component paths /components/com_rsfiles/controllers/rsfiles.php and /components/com_rsfiles/views/upload/tmpl/upload.php as the vulnerable logic locations. Overall, this is an operational exploit rather than a mere detector: it attempts exploitation end-to-end and provides post-exploitation capability through the uploaded PHP file manager shell.