CVE-2026-57827 is a critical (CVSS 9.8) unauthenticated file upload flaw in the RSFiles! extension for Joomla, up to and including version 1.17.11. It can lead to remote code execution. Update to 1.17.12 or later now, then check each site for unexpected files.
What's affected
The record says RSFiles! below 1.17.12 is affected. A write-up by mySites.guru, which found the issue in a source code audit, says versions up to and including 1.17.11 are affected, and that RSJoomla released 1.17.12 on 10 July 2026. It quotes RSJoomla's own advisory, which tells site owners to update immediately.
The component is com_rsfiles, a file manager and download tool. The write-up says the frontend upload task could be reached by anyone with no login and no CSRF token, and the code that wrote the file checked neither permission nor file type. It says the default downloads folder sits inside the web root, where PHP can run.
The same RSJoomla release also fixed some less critical, unreported security issues, per its advisory.
How to check if you're exposed
- In the Joomla administrator, open System, then Manage, then Extensions, and find RSFiles. Read the version.
- Anything up to 1.17.11 is affected.
- Look inside the downloads folder for files with a php extension or other executable types that you did not put there.
- Check access logs for POST requests to the RSFiles upload task from unfamiliar addresses.
- Check for new administrator accounts you do not recognize.
What to do now
- Update RSFiles! to 1.17.12 or later on every Joomla site that uses it.
- Look in the downloads folder for executable files, and remove any you did not create.
- Check for new administrator users, changed passwords and unfamiliar scheduled tasks.
- If you find anything unexpected, treat the site as compromised: restore from a clean backup and rotate credentials.
- Configure the web server to refuse to run scripts in the downloads folder.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. An upload handler that anyone can call, that accepts any file name, and that stores the file where the web server will run it, turns a file manager into a way to run code.
It needs no account and no user action, which explains the 9.8 score. The record is not in CISA's Known Exploited Vulnerabilities catalog. The sources I read describe the fix and the risk but do not report attacks, so I will not claim any. The right course is the same either way: patch now, then look for signs that someone got there first.
Quick check
Is updating enough?
Updating closes the hole. A site that was exposed before the update could already hold a file left behind, so also check the downloads folder and user accounts.
Sources
Last reviewed: 19 October 2026.
