RSFiles! (com_rsfiles) <= 1.17.11 - Unauthenticated Arbitrary File Upload (RCE)

RSFiles! (com_rsfiles) version 1.17.11 and earlier contain an arbitrary file upload flaw in the front-end upload handler that leads to remote code execution. The file-type allow-list and the upload permission check run in a separate pre-flight step, while the method that actually writes the file trusts an attacker-supplied filename and never re-validates the extension, so a .php web shell can be written into the web-served download folder and executed. On builds up to 1.17.11 this is exploitable without any authentication. RSJoomla released a patched build on 2026-07-10 that is STILL numbered 1.17.11 (the version string was not bumped); it only closes the unauthenticated path. A residual bypass remains that lets any user permitted to upload (and any anonymous visitor on sites that allow public uploads) still write an executable .php. Because the version number is unchanged, every install reporting 1.17.11 or lower must be treated as affected. No fixed version is available yet - the issue has been reported to the vendor and a follow-up release is awaited. Mitigation until then: restrict RSFiles uploads to trusted user groups only, or disable uploads entirely (set Enable Upload to No), or turn on the extension's Secure Download Folder option so a .htaccess disables PHP execution in the download folder. Also covered by this rule: CVE-2025-50057, an unauthenticated denial of service via the RSFiles! search feature in 1.16.3 to 1.17.7.

Affected versions: ≤ 1.17.11

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions