EUVD-2026-62489
GHSA-qp23-qqw8-mhp6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network upload with no interaction and no path containment yields RCE; scope changes as the write escapes into the executable web tree affecting the whole host.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove.
AnalysisAI
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote attackers write or remove files anywhere in the component's site and administrator directory trees, enabling web shell deployment and full site compromise. The flaw combines a client-controlled storage root (_path_type), absent path-containment checks, a weak file-extension filter, and a missing CSRF token on the upload/remove handlers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Joomla site to run J-BusinessDirectory before version 6.2.3 and to expose the extension's file upload or remove functionality. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All strong signals point the same way: the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact on both the vulnerable and subsequent system) describes trivially reachable, unauthenticated remote exploitation yielding total compromise, consistent with the 10.0 score and CWE-434's typical RCE outcome. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates a Joomla site running J-BusinessDirectory below 6.2.3 and sends a crafted request to the upload handler, setting _path_type so the file is written into the component's web-accessible directory with a PHP extension that the weak filter permits. Because the endpoint requires no privileges or user interaction (AV:N/AC:L/PR:N/UI:N) and no CSRF token, the attacker then browses to the uploaded file to execute code, or abuses the remove function to delete critical files. … |
| Remediation | Upgrade J-BusinessDirectory to version 6.2.3 or later, which enforces path containment, removes the client-controlled root, and hardens the file-type check (Vendor-released patch: 6.2.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of all Joomla deployments to identify those using J-BusinessDirectory versions prior to 6.2.3, immediately disable the vulnerable extension on all affected systems, and restrict public network access to these installations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in the J-BusinessDirectory extension for Joomla (by cmsjunkie.com) before version 6.2.3 lets remote attack
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attacke
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attack
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version
Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exp
Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com)
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today