CVE-2026-75949 in J-BusinessDirectory Extension
Summary
by MITRE • 08/19/2026
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in J-BusinessDirectory versions prior to 6.2.3 represents a critical security flaw involving arbitrary file upload and deletion capabilities driven by insufficient input validation and the absence of protective access controls. This issue stems from a path traversal weakness where the application fails to enforce strict directory containment for user-supplied inputs. Specifically, the component accepts client-controlled parameters that dictate the root path type, allowing an attacker to manipulate internal variables such as _path_type to point towards sensitive directories within both the site and administrator trees of the Joomla installation. By bypassing expected boundary checks, an adversary can navigate outside the intended upload or deletion scope, effectively gaining write access to arbitrary locations on the server filesystem where the web application resides.
The technical mechanism behind this exploitation relies on the component's failure to sanitize file paths before processing them for storage or removal operations. The extension utilized a weak method of verifying whether uploaded files were legitimate extensions rather than malicious payloads like PHP scripts or shell code. This lack of rigorous validation allows attackers to upload executable content directly into accessible directories. Furthermore, the deletion functionality suffers from similar flaws, enabling unauthorized users to remove critical system files or configuration data by specifying paths that traverse beyond permitted boundaries. The combination of these two capabilities creates a severe risk where an attacker can not only compromise the integrity and confidentiality of the web application but also potentially achieve remote code execution if they manage to upload a malicious script into a directory with execute permissions.
Compounding the severity of this vulnerability is the complete absence of Cross-Site Request Forgery (CSRF) protection on both the file upload and deletion endpoints. Without valid CSRF tokens, an attacker can craft simple HTML forms or JavaScript payloads that trick authenticated administrators into performing these actions without their knowledge or consent. This means that even if a user is logged in with standard privileges, they could be coerced into uploading malicious files or deleting essential components simply by visiting a malicious website while still authenticated to the Joomla instance. The lack of anti-CSRF measures significantly lowers the barrier for exploitation, allowing unauthenticated attackers to trigger these actions against any valid session token obtained through other means such as cookie theft or social engineering.
From an industry standard perspective, this vulnerability maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes how software does not properly neutralize special elements within a pathname that can cause the path to resolve to a location outside of the intended directory. Additionally, the arbitrary file upload aspect aligns with CWE-434: Unrestricted Upload of File with Dangerous Type, highlighting the failure to restrict file types based on their content or extension in a secure manner. The missing CSRF tokens correspond to CWE-352: Cross-Site Request Forgery (CSRF), indicating that the application does not verify the origin and intent of state-changing requests. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques such as T1505.003: Web Shell, where attackers install web shells for persistent access, and T1485: Data Destruction, through the arbitrary file deletion capability that can lead to denial of service or data loss.
The operational impact of these flaws is substantial, potentially leading to full system compromise, defacement of the website, theft of sensitive user data stored within the Joomla database via exposed configuration files, and disruption of business operations due to deleted critical components. For organizations relying on J-BusinessDirectory for their online presence or directory services, this vulnerability poses a direct threat to availability, integrity, and confidentiality. The ability to delete arbitrary files can render the application unusable, while uploading malicious scripts provides attackers with a foothold to escalate privileges further within the server environment.
To mitigate these risks, immediate action is required by upgrading J-BusinessDirectory to version 6.2.3 or later where these path traversal and CSRF issues have been addressed. Administrators should also implement additional defensive layers such as web application firewalls that can detect and block common path traversal patterns like dot-dot-slash sequences in request parameters. It is crucial to ensure that the Joomla installation follows strict file permission best practices, restricting write access only to necessary directories and ensuring that uploaded files are stored outside of executable paths whenever possible. Regular security audits and penetration testing should be conducted to identify similar weaknesses in other extensions or custom code within the Joomla ecosystem, ensuring a robust defense-in-depth strategy against exploitation attempts.