CVE-2026-75949: Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (pathtype could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
J-BusinessDirectory (Joomla Extension)to a version that resolves this vulnerability.Fixed in 6.2.3
Event History
Frequently Asked Questions
Which deployments are affected?
J-BusinessDirectory versions earlier than 6.2.3 are affected. The issue applies to the extension's upload and removal functionality because it accepted a client-controlled root that could target the component's site or administrator directory trees.
What does an attacker need to exploit this?
The affected upload/remove operations lacked CSRF token protection, so a victim could be induced to submit a request. Exploitation also relies on controlling the path type and using traversal where path containment is not enforced; the upload validation used a weak extension check.
What can be done if upgrading is not immediately possible?
Restrict or disable access to the affected J-BusinessDirectory upload and removal functionality until the extension can be updated. Review the component's site and administrator directory trees for unexpected uploaded files or missing files, since the issue permits arbitrary upload and deletion within those trees.