webshellseo8/CVE-2026-21628-POC

GitHubRepository PoCExploit

PoC files

8 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-21628 in Astroid Framework for Joomla to achieve unauthenticated remote code execution by uploading a webshell via the media upload endpoint and optionally using an installTemplate fallback.

Backdoor review

Suspicious behavior

The PoC exploits CVE-2026-21628 to upload a webshell. It contains a fallback method (installTemplate) that instructs the target server to download and install a ZIP from a hardcoded external URL (http://pastebin.store/template.zip). The ZIP's contents are not provided for review, and the PoC's own documentation does not disclose that this fallback fetches an uninspected remote payload. This concealment of a critical operator-run code path creates concern, but without the ZIP's contents, concealed harm is not directly established.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareAstroid Template FrameworkJoomla
Attack typesRemote Code ExecutionUnrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads and executes a webshell on a remote target, which constitutes exploitation. It does not merely detect the vulnerability; it performs the full attack chain (upload, rename, verify execution) and includes a fallback exploitation method.

CVE-2026-21628.py:238-297CVE-2026-21628.py:300-333CVE-2026-21628.py:337-349CVE-2026-21628.py:400-454

Requirements

  • Target must be running a vulnerable version of Astroid Framework (2.0.0-3.3.10) on Joomla.CVE-2026-21628.py:3
  • Target must have the Astroid media upload endpoint accessible at /administrator/index.php.CVE-2026-21628.py:247-249
  • A valid CSRF token must be obtainable from the target's administrator login page.CVE-2026-21628.py:217-234

Observed behavior

  • Fetches a CSRF token from the target's /administrator/ page.CVE-2026-21628.py:217-234
  • Uploads a PHP webshell disguised as an SVG file via the Astroid media upload AJAX endpoint.CVE-2026-21628.py:238-297
  • Renames the uploaded .svg file to .php (or other executable extensions) using the media rename endpoint.CVE-2026-21628.py:300-333
  • Verifies successful webshell execution by checking for a unique marker in the HTTP response.CVE-2026-21628.py:337-349
  • If the primary upload/rename method fails, attempts a fallback installTemplate method that drops a webshell via a malicious ZIP file.CVE-2026-21628.py:400-454
  • Saves successfully exploited URLs to a local file (upload.txt).CVE-2026-21628.py:457-460
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Remote Payload
  • The installTemplate fallback method instructs the target server to download and install a ZIP archive from a hardcoded external URL (http://pastebin.store/template.zip). The contents of this ZIP are not included in the repository, and the PoC's documentation does not disclose that this fallback fetches an uninspected remote payload. The operator cannot review what code will be executed on the target.CVE-2026-21628.py:160-161CVE-2026-21628.py:400-454

Observables

Url
http://pastebin.store/template.zipHardcoded external URL used by the installTemplate fallback to fetch a ZIP payload for installation on the target server.CVE-2026-21628.py:160
Url
https://webshell.store/Promotional link in the script's docstring and README, indicating the author's commercial interest in webshells.CVE-2026-21628.py:9README.md:4
Review boundaries

What the analysis did not establish

  • Six binary files (shell.phar, shell.php, shell.php5, shell.php7, shell.php8, shell.phtml) were not inspected; their content is unknown.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all files in the repository were included in the analysis.
  • The contents of the remote ZIP archive at http://pastebin.store/template.zip are not included in the repository and were not reviewed.
  • Six binary files (shell.phar, shell.php, shell.php5, shell.php7, shell.php8, shell.phtml) were flagged as binary and not analyzed; their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1