SP Property CVE-2026-78085

The SP Property Joomla extension must be installed and active on the target Joomla site, and the gallery management controller task endpoint must be publicly reachable without authentication (confirmed by PR:N in the CVSS 4.0 vector). No special Joomla configuration or elevated account privileges are required by the attacker. Exploitation is limited by the web server process permissions - the traversal can only reach filesystem paths accessible to the account running the web server. All versions of SP Property prior to 4.1.4 are vulnerable; sites already running 4.1.4 or later are not affected. The absence of confidentiality impact (VC:N/SC:N) indicates file read operations outside the gallery root are not the primary exposure vector under the assessed impact model.

The CVSS 4.0 score of 6.9 (Medium) reflects unauthenticated network reachability (AV:N, AC:L, PR:N, UI:N) combined with low-severity impacts across both vulnerable-system and subsequent-system dimensions, with no confidentiality impact at any layer. The PR:N and UI:N combination means exploitation can be scripted with no preconditions on the attacker side, raising automation potential. However, the absence of High or Critical impact ratings (all impacts are Low) caps real-world damage - this vulnerability does not appear to enable remote code execution or significant data exfiltration on its own. No KEV listing confirms no observed active exploitation; no POC has been disclosed; EPSS data is absent from the available intelligence. The most realistic risk is unauthenticated file writes or reads outside the gallery directory bounded by web server process permissions, which could undermine site integrity or be chained with other vulnerabilities for greater effect. CVSS 4.0's subsequent-system impact (SI:L/SA:L) suggests that files reachable beyond the Joomla application directory may be affected depending on server configuration.

An unauthenticated attacker sends a crafted HTTP request to the SP Property gallery management controller endpoint, embedding path-traversal sequences (e.g., ../../) within a gallery image task parameter. Because no directory confinement check is applied, the controller resolves the traversed path and performs file operations (write, access, or delete) outside the intended gallery root directory. Depending on web server permissions, this could allow the attacker to place or overwrite files in other web-accessible directories, affecting site integrity.