J-BusinessDirectory CVE-2026-75949

Exploitation requires the target Joomla site to run J-BusinessDirectory before version 6.2.3 and to expose the extension's file upload or remove functionality. The specific enabling conditions are named in the advisory: the upload/remove handlers accept a client-controlled _path_type root that can point at the component site or admin trees, perform no path-containment/canonicalization, apply only a weak (non-allowlist) extension check, and lack a CSRF token. Per the vendor vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is claimed to be required against affected versions; the practical limiting factors are that the site must be reachable and still running a pre-6.2.3 build, and defenders should verify whether the upload endpoint is truly unauthenticated given that the missing-CSRF detail typically implies a logged-in victim.

All strong signals point the same way: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact on both the vulnerable and subsequent system) describes trivially reachable, unauthenticated remote exploitation yielding total compromise, consistent with the 10.0 score and CWE-434's typical RCE outcome. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no POC was referenced either, so this is 'no public exploit identified at time of analysis' rather than a confirmed in-the-wild threat. The one tension worth verifying: the description highlights a missing CSRF token, which normally implies an authenticated victim is tricked into a state-changing request, yet the vector claims PR:N/UI:N (fully unauthenticated, no interaction) - this suggests the upload/remove endpoints were also reachable without authentication, but defenders should confirm with the vendor whether exploitation truly needs no session. Overall this is a genuine high priority for any exposed J-BusinessDirectory install given the RCE potential and zero-privilege vector, tempered only by the extension's limited deployment footprint.

An attacker locates a Joomla site running J-BusinessDirectory below 6.2.3 and sends a crafted request to the upload handler, setting _path_type so the file is written into the component's web-accessible directory with a PHP extension that the weak filter permits. Because the endpoint requires no privileges or user interaction (AV:N/AC:L/PR:N/UI:N) and no CSRF token, the attacker then browses to the uploaded file to execute code, or abuses the remove function to delete critical files. No public POC was referenced in the source data.