CVE-2026-75949
Received Received - Intake

Arbitrary File Upload/Deletion in J-BusinessDirectory

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Joomla! Project

Description
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75949
EUVD
EUVD-2026-62489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cmsjunkie j-businessdirectory to 6.2.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an arbitrary file upload and deletion issue in the J-BusinessDirectory Joomla extension versions before 6.2.3. It allows attackers to upload or remove files outside intended directories due to path traversal and weak extension checks. The lack of CSRF tokens also enables unauthorized actions.

Detection Guidance

Check for unauthorized file uploads or deletions in Joomla's J-BusinessDirectory component. Inspect web server logs for suspicious paths containing '../' or similar traversal patterns. Verify if the component version is below 6.2.3.

Impact Analysis

Attackers could upload malicious files to your server, delete critical files, or gain control over your Joomla site. This could lead to data breaches, defacement, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update J-BusinessDirectory to version 6.2.3 or later immediately. Disable file upload/removal features if not required. Implement strict file upload validation and path containment checks. Add CSRF tokens to upload/remove actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75949. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart