The lomart.fr UP plugin for Joomla versions 5.0.0-5.2.0 and 6.0.0-6.0.29 contains multiple path traversal and file access vulnerabilities (CWE-22) that improperly restrict pathname access, potentially allowing attackers to access unauthorized files. The vulnerability is unauthenticated and remotely exploitable, with a CVSS 4.0 score of 9.2, reflecting critical severity. No vendor advisory or patch information is currently available.

Successful exploitation could allow an unauthenticated remote attacker to access sensitive files outside the intended directory restrictions, potentially leading to disclosure of confidential information and compromise of system security controls. The vulnerability does not require user interaction or privileges, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual file access patterns. Avoid exposing the plugin to untrusted networks if possible.