CVE-2026-75949: J-BusinessDirectory Path Traversal Flaw

CVE-2026-75949 Overview

CVE-2026-75949 is an arbitrary file upload and deletion vulnerability affecting the J-BusinessDirectory Joomla extension developed by cmsjunkie.com. The flaw exists in versions prior to 6.2.3 and combines path traversal, weak file extension validation, and missing Cross-Site Request Forgery (CSRF) protection. The upload and remove handlers accept a client-controlled _path_type parameter that can point at the component's site or admin directory trees. The endpoints do not enforce path containment, allowing attackers to write or delete files outside the intended upload directory. This vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
Unauthenticated remote attackers can upload arbitrary files or delete files anywhere the web server can write, leading to remote code execution and full site compromise.

Affected Products

J-BusinessDirectory Joomla extension versions prior to 6.2.3
Vendor: cmsjunkie.com
Joomla installations with the vulnerable component installed

Discovery Timeline

2026-08-19 - CVE-2026-75949 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75949

Vulnerability Analysis

The J-BusinessDirectory extension exposes upload and remove endpoints that trust a client-supplied _path_type parameter to determine the destination directory. Attackers can set this parameter to reference the component's site or admin trees. The handlers concatenate this input into filesystem paths without normalizing traversal sequences or validating the resolved path against an allow-list. This design allows write and delete primitives across the Joomla installation directory tree.

The file extension check is described as weak, meaning attackers can bypass filters and upload executable content such as PHP files. Combined with the missing CSRF token on both upload and remove operations, the endpoints can be triggered by cross-origin requests that abuse an authenticated user's session or by direct unauthenticated calls where session controls are absent.

Root Cause

The root cause is a combination of three defects. First, the destination directory is derived from client input (_path_type) rather than a server-side allow-list. Second, the code lacks path containment checks that would ensure the resolved path stays within the intended uploads directory after resolving .. sequences. Third, the extension check does not reliably block dangerous file types, and no anti-CSRF token is required on state-changing requests.

Attack Vector

An attacker crafts an HTTP request to the vulnerable upload endpoint, supplying a _path_type value that traverses to a web-accessible directory. The attacker attaches a payload file that bypasses the weak extension check, for example by using double extensions or content-type manipulation. Once written, the file can be requested directly through the web server to trigger execution. Alternatively, the delete endpoint can be abused to remove arbitrary files, causing denial of service or removing security controls.

The absence of CSRF tokens means an authenticated administrator visiting an attacker-controlled page can be forced into performing the upload or removal. The vulnerability is reachable over the network with no authentication and no user interaction, according to the published CVSS 4.0 vector.

See the CMS Junkie Blog for vendor advisory details.

Detection Methods for CVE-2026-75949

Indicators of Compromise

Unexpected .php, .phtml, or .phar files present in J-BusinessDirectory upload directories or component subfolders
HTTP requests to J-BusinessDirectory upload or remove endpoints containing _path_type parameter values with ../ sequences or absolute paths
Missing or unexpectedly deleted files in components/com_jbusinessdirectory/ directory trees
Web server processes spawning shells or outbound connections shortly after file writes to Joomla component directories

Detection Strategies

Inspect web server access logs for POST requests to J-BusinessDirectory endpoints that include the _path_type parameter
Deploy web application firewall (WAF) rules to flag path traversal patterns in request bodies targeting Joomla component URLs
Monitor filesystem integrity of the Joomla webroot for new executable files created outside expected upload paths

Monitoring Recommendations

Enable file integrity monitoring across components/, administrator/components/, and media/ directories
Alert on web server child processes that execute shell binaries, package managers, or network utilities
Correlate authentication events with subsequent file write activity to detect CSRF-driven abuse

How to Mitigate CVE-2026-75949

Immediate Actions Required

Upgrade J-BusinessDirectory to version 6.2.3 or later on all Joomla instances
Audit component upload directories for files created before the patch was applied and remove any that are not attributable to legitimate uploads
Review Joomla and web server logs for prior exploitation attempts referencing _path_type

Patch Information

Upgrade to J-BusinessDirectory 6.2.3 or later, which enforces server-side path containment, removes the client-controlled root, strengthens the extension check, and adds CSRF token validation to upload and remove operations. Refer to the CMS Junkie Blog for the vendor's release notes.

Workarounds

Restrict access to the J-BusinessDirectory upload and remove endpoints at the web server or WAF layer until the patch is applied
Disable the J-BusinessDirectory extension in the Joomla administrator console if immediate patching is not possible
Enforce execution restrictions on Joomla upload directories by disallowing PHP interpretation in media/ and component upload paths

bash

# Example Apache configuration to block PHP execution in upload directories
<Directory "/var/www/joomla/components/com_jbusinessdirectory/">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>