CVE-2026-78084 in SP Property Extension
Summary
by MITRE • 09/10/2026
Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified file types.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within the joomshaper.com extension for Joomla, specifically affecting SP Property versions prior to 4.1.4, represents a critical failure in server-side access control and input validation mechanisms. This flaw is rooted in the gallery management controller tasks which were implemented without adequate authorization checks or Cross-Site Request Forgery (CSRF) token validation. In secure web application architecture, every action that modifies state on the server must be protected by both authentication to verify user identity and CSRF protection to ensure the request originated from a legitimate source within the same session context. The absence of these controls allows any authenticated user with access to the gallery management interface, or potentially unauthenticated users depending on the specific Joomla configuration and role assignments, to execute administrative-level operations without proper permission verification. This lack of enforcement creates an environment where standard security boundaries are effectively bypassed through direct manipulation of HTTP requests targeting the vulnerable controller endpoints.
The technical exploitation vector involves two primary attack surfaces: arbitrary file deletion via path traversal and unauthorized file uploads with unverified types. Regarding the removal functionality, attackers can supply arbitrary path strings in their request parameters to specify files for deletion outside of the intended gallery directory structure. This behavior is characteristic of a Path Traversal vulnerability, often categorized under CWE-22 Improper Limitation of a Pathname to a Restricted Directory. By manipulating relative or absolute paths within the file removal action, an attacker can target sensitive system files, configuration files containing database credentials, or other critical assets located in directories above the web root if the server allows such access. This capability not only leads to data loss and service disruption but also facilitates further reconnaissance by revealing directory structures through error messages or behavioral changes when accessing non-existent paths.
The second aspect of this vulnerability involves the upload functionality which fails to validate file types before processing them. When a user uploads an image, the system does not sufficiently verify that the uploaded content matches the expected MIME type or extension for gallery images. This oversight aligns with CWE-434 Unrestricted Upload of File with Dangerous Type and allows attackers to upload malicious scripts such as PHP webshells disguised as image files. Once these files are stored on the server, they can be executed by the web server if it is configured to process script files within the gallery directory or if the attacker can leverage other vulnerabilities like Local File Inclusion to trigger execution. This effectively grants the attacker remote code execution capabilities with the privileges of the web server user account, leading to complete compromise of the underlying Joomla installation and potentially the host system itself.
From an operational impact perspective, this vulnerability enables a range of severe consequences including unauthorized data modification, defacement of public-facing websites through image replacement or script injection, and full system takeover via uploaded backdoors. The lack of CSRF protection means that these attacks can be launched using social engineering techniques where a victim with administrative privileges is tricked into visiting a malicious page containing crafted requests. This significantly lowers the barrier for exploitation as it does not require complex manual interaction beyond clicking a link or loading an image in certain browser contexts, depending on how Joomla handles session cookies and request origins. The combination of these flaws creates a high-severity risk profile that threatens the integrity, availability, and confidentiality of any website running the affected version of SP Property.
Mitigation strategies must prioritize immediate patching to version 4.1.4 or later where these access control mechanisms have been corrected by the vendor. In environments where updating is not immediately feasible, administrators should implement strict input validation on all file upload parameters using allowlists for permitted extensions and MIME types rather than relying solely on client-side checks. Additionally, deploying a Web Application Firewall can help mitigate path traversal attempts by blocking requests containing suspicious directory traversal sequences such as dot-dot-slash or encoded variations thereof. It is also critical to ensure that the web server configuration restricts execution permissions in directories designated for static media uploads, preventing any uploaded scripts from being executed even if they bypass initial validation checks. Regular security audits and adherence to OWASP guidelines for access control and file upload handling are essential to prevent recurrence of such vulnerabilities in future development cycles.