The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload

CVE-2026-57827 is an unauthenticated arbitrary file upload in the Joomla third-party extension RSFiles (by RSJoomla). The extension's upload handler accepts POSTs from anonymous visitors and writes the file straight into /downloads without enforcing any allow-list on the extension. Because that directory is served by Apache/PHP-FPM as executable content on default LAMP stacks, an attacker drops a .php webshell and immediately requests it back to get code execution as the web user. Affected: RSFiles < 1.17.12. Fixed in RSFiles 1.17.12.

There is no vendor/authority CVSS score for this CVE — noisgate is establishing the first assessment. On the CIA/AC/AT/PR/UI axis the bug scores brutally: AV:N / AC:L / AT:N / PR:N / UI:N / S:U / C:H / I:H / A:H. That maps to CVSS ~9.8 in raw form. We assess it at HIGH (8.6) rather than CRITICAL because the installed base is small (RSFiles is a paid RSJoomla add-on with modest deployment), and the class — unauth file upload in a Joomla extension — is well-covered by WAF signatures and generic upload scanners. But make no mistake: on any host that actually runs it, this is *pre-auth RCE with no chain*.

Why this verdict

• Pre-auth RCE with no chain: the attacker needs only network reach; no credentials, no user interaction, no second bug. This is the platonic worst-case for a web CMS.
• Role multiplier — public-facing web tier: RSFiles is deployed on internet-exposed Joomla sites by definition. Chain succeeds in every realistic deployment, but blast radius is one Joomla site + its DB, not fleet-scale. This keeps the floor at HIGH, not CRITICAL.
• Role multiplier — regulated data hosting: where RSFiles hosts membership sites, customer downloads, or GDPR-scope content, the DB dump in step 4 is a reportable breach. Still per-tenant, not fleet-scale.
• Installed-base narrowing: RSFiles is a paid RSJoomla add-on with a Shodan footprint in the low thousands — versus JCE or SP Page Builder which sit on hundreds of thousands of sites. Real-world exposure population is materially smaller.
• Detection is easy: OWASP CRS PL2+, Cloudflare Managed Ruleset, and any competent WAF already catch anonymous multipart uploads with .php filenames. Sites behind a modern WAF have meaningful pre-patch protection.

Why not higher?

CRITICAL is reserved for canonical high-value-role components (hypervisors, identity providers, network edge, backup, PKI) or widely-deployed software with active exploitation. RSFiles is neither — it's a niche paid extension with no observed exploitation on day zero, and the blast radius is capped at the individual Joomla site rather than fleet or supply chain.

Why not lower?

MEDIUM would require meaningful prerequisites (auth, user interaction, unusual config) — this vuln has none. The chain is pre-auth, network-reachable, single-step, and lands SYSTEM-equivalent code execution in the web user context. Any lower rating would misrepresent the exploit primitive.

1. Disable PHP execution in /downloads — Add <Directory /var/www/joomla/downloads> php_flag engine off </Directory> (Apache) or location ~ ^/downloads/.*\.php$ { deny all; } (nginx). Even if a file gets written, it will not execute. Deploy within 30 days per noisgate mitigation SLA — or within hours if you cannot patch immediately.
2. Block anonymous POSTs to RSFiles upload endpoints at the WAF — Add a rule denying unauthenticated multipart/form-data to any URL containing com_rsfiles and task=upload. On Cloudflare/Akamai/AWS WAF this is a one-line custom rule. Ship within 30 days.
3. Upgrade to RSFiles 1.17.12 — The actual fix. Test in staging, then push to production. Complete within 180 days per noisgate remediation SLA, but for pre-auth RCE you should target ≤ 14 days.
4. Audit /downloads for existing webshells before you patch — Assume-breach: find /var/www/joomla/downloads -name '*.php*' -o -name '*.phtml' -o -name '*.phar' and diff against the extension's expected inventory. If you find hits, treat as an active IR event.
5. Rotate Joomla DB credentials and super-admin passwords post-patch — If exploitation happened pre-detection, configuration.php is stolen. Rotate db.user password, force a full admin credential reset, and invalidate all session tokens.

Run this on each Joomla web host as root or the user that owns the Joomla docroot. Invoke: sudo ./check-rsfiles.sh /var/www/joomla. It reads the RSFiles manifest XML and compares the installed version against the fixed release. Also greps /downloads for suspicious PHP artifacts.

#!/usr/bin/env bash
# noisgate: CVE-2026-57827 RSFiles unauth arbitrary file upload check
# Usage: sudo ./check-rsfiles.sh /path/to/joomla/docroot
set -u

DOCROOT="${1:-/var/www/joomla}"
FIXED="1.17.12"

if [[ ! -d "$DOCROOT" ]]; then
  echo "UNKNOWN: docroot $DOCROOT not found"
  exit 2
fi

# Locate the RSFiles component manifest
MANIFEST=$(find "$DOCROOT/administrator/components/com_rsfiles" -maxdepth 2 -name 'rsfiles.xml' 2>/dev/null | head -n1)
if [[ -z "$MANIFEST" ]]; then
  echo "PATCHED: com_rsfiles not installed on $DOCROOT"
  exit 0
fi

# Extract <version> from the XML
VERSION=$(grep -oP '(?<=<version>)[^<]+' "$MANIFEST" | head -n1)
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not parse version from $MANIFEST"
  exit 2
fi

# Version comparison (dotted numeric)
ver_lt() {
  [[ "$1" == "$2" ]] && return 1
  [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" == "$1" ]]
}

STATUS="PATCHED"
if ver_lt "$VERSION" "$FIXED"; then
  STATUS="VULNERABLE"
fi

# Look for dropped webshells in /downloads
SHELLS=$(find "$DOCROOT"/downloads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php?' \) 2>/dev/null)

echo "RSFiles version: $VERSION (fixed: $FIXED)"
echo "Status: $STATUS"
if [[ -n "$SHELLS" ]]; then
  echo "WARNING: PHP artifacts found in /downloads (possible webshells):"
  echo "$SHELLS"
  echo "Status: VULNERABLE (assume-breach)"
  exit 1
fi

[[ "$STATUS" == "VULNERABLE" ]] && exit 1 || exit 0

Sources

1. RSJoomla forum — RSFiles 1.17.12 security update announcement
2. CCB Belgium advisory — CVE-2026-56290 (analogous Joomla extension file-upload)
3. Mallory — Unauthenticated file upload RCE in Joomla Page Builder CK (class reference)
4. IONIX — CVE-2026-48908 SP Page Builder unauth file upload (class reference)
5. Invicti — Joomla JCE arbitrary file upload (historical class reference)
6. Acunetix — Joomla core arbitrary file upload signatures
7. MITRE CWE-434 — Unrestricted Upload of File with Dangerous Type
8. OWASP — File Upload Cheat Sheet