Found by mySites.guru · Fix available

RSFiles! just fixed a flaw that let a stranger run code on your site

RSFiles! is a widely used file and download manager for Joomla. Up to and including version 1.17.11, its frontend upload could be reached by anyone, with no login and no security token, and the code that actually wrote the file to disk checked nothing about its type. Put those together and an anonymous visitor could upload a .php file into the public downloads folder and then run it, which is remote code execution, the worst outcome a web flaw can have.

I found this during a routine source audit of the extensions our customers rely on, proved the whole chain end to end on a local Joomla install, and reported it privately to RSJoomla before saying a word in public. They replied the same day, shipped the fix in RSFiles! 1.17.12, and published a clear advisory telling site owners to update now. A CVE has been requested and is pending. No proof of concept has been made public, so this isn't a recipe going out ahead of the fix.

If you run any Joomla site with RSFiles! on it, update every one to 1.17.12 or later today. This isn't a wait-for-the-next-maintenance-window job. Any site still on 1.17.11 or earlier is reachable by anyone on the internet, so update it, then check the downloads folder for stray files and your admin user list for accounts you don't recognise, because an unauthenticated upload leaves no login trail behind.

The full write-up, including what the fix changes, is free to read on the blog

How the flaw worked, and how to check your sites

The checks RSFiles! does have, a permission gate and a file-type allow-list, lived in a pre-flight step that writes nothing, while the method that actually saved the file ran no checks and trusted the filename the caller sent. It's the same class of flaw, an unauthenticated file upload, that was fixed recently in Balbooa Forms, iCagenda, Page Builder CK and JCE. The post walks through what was wrong, what 1.17.12 changes, and exactly what to look for on a site that sat on an old version, without publishing anything an attacker could copy.

If you manage more than a handful of Joomla sites, mySites.guru lists every RSFiles! install in your account, so you can see at a glance which ones still need the update.

Need help with your site? Phil Taylor – Fixing websites since 2004

Found something wrong with your Joomla or WordPress site? If it were simple, you'd have fixed it already. I offer same-day expert help at a flat rate of £120 per incident. No hourly billing surprises.

If I can't add value, you don't pay