CVE-2026-78085 in SP Property Extension
Summary
by MITRE • 09/10/2026
Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked directory confinement checks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within the SP Property extension for Joomla, specifically affecting versions prior to 4.1.4, represents a critical path traversal flaw located in the gallery image management functionality. This component is responsible for handling user-uploaded images and managing their storage locations on the server file system. The core technical deficiency lies in the controller tasks associated with this module, which fail to implement adequate directory confinement checks when processing input parameters related to file paths or operations. In a secure implementation, any operation involving file manipulation must strictly validate that the target path resides within an expected, whitelisted base directory. However, due to the absence of these safeguards, the application does not properly sanitize user-supplied data before using it in filesystem functions such as move_uploaded_file or unlink. This oversight allows an attacker to manipulate relative paths by injecting sequence characters like dot-dot-slash, effectively breaking out of the intended upload directory and accessing arbitrary locations on the server's file system.
From a technical perspective, this flaw aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerability exploits the lack of canonicalization or strict boundary enforcement in the backend logic that handles gallery images. When an authenticated user interacts with the gallery management interface, they can supply crafted input strings containing path traversal sequences. Because the server processes these inputs without verifying that the resulting absolute path remains within the designated web root or upload folder, it may perform actions such as reading sensitive configuration files, overwriting existing scripts, or deleting critical system files depending on the permissions of the web server process. This type of vulnerability is particularly dangerous because it can lead to unauthorized data access and potentially remote code execution if an attacker manages to write a malicious script into a writable directory that is subsequently executed by the web server.
The operational impact of this path traversal vulnerability extends beyond simple file disclosure. An attacker with valid credentials, which are often easily obtainable through credential stuffing or phishing attacks against Joomla sites using vulnerable extensions, can leverage this flaw to compromise the integrity and confidentiality of the entire website infrastructure. By reading files such as configuration.php, attackers can extract database credentials, API keys, and other sensitive secrets stored in plaintext within these config files. Furthermore, if the web server allows execution of scripts from specific directories, an attacker could upload a PHP shell by traversing to a writable directory outside the restricted gallery path and then executing it via HTTP requests. This effectively grants full control over the underlying operating system, enabling further lateral movement within the network or deployment of ransomware and other malicious payloads.
This vulnerability is also relevant to MITRE ATT&CK techniques related to Initial Access and Execution. Specifically, it maps to T1505: Server Software Component, where attackers install backdoors through vulnerable components like Joomla extensions. The exploitation path typically involves T1190: Exploit Public-Facing Application, as the vulnerability resides in a feature accessible via the web interface. Once initial access is gained through this flaw, subsequent actions such as T1083: File and Directory Discovery or T1564: Hide Artifacts can be performed to maintain persistence and evade detection by security monitoring tools. The lack of input validation serves as an entry point that bypasses standard authentication controls in terms of file system access boundaries, highlighting a failure in the principle of least privilege regarding resource access.
Mitigation strategies for this vulnerability primarily involve upgrading the SP Property extension to version 4.1.4 or later, where these directory confinement checks have been implemented by the developers. For organizations unable to upgrade immediately due to compatibility constraints with other plugins or custom code modifications, several defensive measures can be employed at the infrastructure level. Web Application Firewalls (WAFs) should be configured to detect and block HTTP requests containing path traversal sequences such as ../ in parameters associated with file operations. Additionally, server-side hardening is crucial; ensuring that the web server process runs under a restricted user account with minimal permissions limits the damage an attacker can cause even if they successfully exploit this flaw. It is also advisable to disable directory listing and restrict write permissions on directories where sensitive configuration files are stored, preventing attackers from reading or modifying critical system data regardless of application-level vulnerabilities. Regular auditing of third-party extensions for known CVEs and maintaining a strict policy against using outdated software components are essential practices in mitigating such risks proactively.