CVE-2026-78084: Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified file types.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - joomshaper.comto a version that resolves this vulnerability.Fixed in 4.1.4 - Compensating control
Until upgraded, restrict access to the affected Gallery Image Management endpoints/controllers and ensure requests require valid CSRF tokens so unauthenticated/forged requests cannot invoke file removal or upload actions.
Event History
Frequently Asked Questions
Which deployments are affected?
SP Property versions earlier than 4.1.4 are affected. The issue is in gallery image management controller tasks.
What access does an attacker need?
The affected controller tasks lacked authorization checks, so users could invoke file removal actions using arbitrary path strings or upload unverified file types. The provided information does not specify a required privilege level.
What actions are possible through the vulnerable functionality?
An attacker could trigger file removal actions with arbitrary path strings and upload file types that are not verified. The controller tasks also lacked CSRF token validation.
How can I determine whether I need to remediate?
Check whether SP Property is installed and identify its version. Installations running a version earlier than 4.1.4 should be treated as affected.