CVE-2026-78085 Overview
CVE-2026-78085 is a path traversal vulnerability [CWE-22] in the JoomShaper SP Property extension for Joomla. Versions prior to 4.1.4 fail to enforce directory confinement checks in the gallery image management controller tasks. Unauthenticated attackers can traverse the file system through the network attack vector and manipulate files outside the intended gallery directory. The flaw affects integrity and availability of the underlying web application while leaving confidentiality unaffected.
Critical Impact
Unauthenticated remote attackers can traverse directories through gallery management tasks to write or delete files outside the intended path, impacting site integrity and availability.
Affected Products
- JoomShaper SP Property extension for Joomla, versions prior to 4.1.4
- Joomla sites running the SP Property real estate component
- Web servers hosting vulnerable SP Property gallery management endpoints
Discovery Timeline
- 2026-09-10 - CVE-2026-78085 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-78085
Vulnerability Analysis
The SP Property extension exposes controller tasks that manage gallery images for property listings. These tasks accept file path parameters but omit checks that confine operations to the designated gallery directory. Attackers supply crafted path parameters containing traversal sequences such as ../ to reach arbitrary locations on the server. The controller then performs file operations against attacker-chosen targets outside the gallery root. The bug is exploitable across the network without authentication or user interaction.
Root Cause
The root cause is missing directory confinement validation in the gallery management controller tasks. The code trusts client-supplied file path input and does not canonicalize the resolved path or verify that it remains within the gallery base directory. This maps directly to CWE-22, Improper Limitation of a Pathname to a Restricted Directory. Without a canonicalization step and an allowlist check, traversal sequences pass through to underlying file system calls.
Attack Vector
An attacker sends HTTP requests to the vulnerable SP Property gallery management task endpoints with path parameters containing directory traversal sequences. Because no authentication is required, exploitation can be attempted directly against any exposed Joomla site running SP Property below version 4.1.4. Successful exploitation allows manipulation of files outside the gallery scope, which can degrade site integrity and disrupt availability. See the JoomShaper SP Property Extension product page for component context.
No verified public proof-of-concept code is available at this time. The vulnerability mechanism is described in prose above; refer to the vendor advisory for implementation-level detail.
Detection Methods for CVE-2026-78085
Indicators of Compromise
- HTTP requests to SP Property gallery controller tasks containing ../ or URL-encoded %2e%2e%2f sequences in file path parameters
- Unexpected file creation, modification, or deletion outside the SP Property gallery upload directory
- Web server access logs showing repeated requests to gallery management task endpoints from a single source
Detection Strategies
- Inspect Joomla and web server logs for requests to index.php with option=com_spproperty and gallery management task parameters containing traversal patterns
- Deploy web application firewall rules that block path traversal payloads on requests targeting the SP Property component
- Correlate file integrity monitoring alerts on the Joomla web root with inbound HTTP requests to SP Property endpoints
Monitoring Recommendations
- Enable file integrity monitoring across the Joomla installation directory and media folders
- Forward web server and Joomla application logs to a centralized log platform for anomaly review
- Alert on any write or delete operation against sensitive Joomla files such as configuration.php originating from the web server process
How to Mitigate CVE-2026-78085
Immediate Actions Required
- Upgrade the SP Property extension to version 4.1.4 or later on all Joomla installations
- Audit the Joomla web root and gallery directories for unauthorized file changes since the extension was installed
- Restrict access to Joomla administrative and component endpoints using IP allowlists where feasible
Patch Information
JoomShaper addresses the issue in SP Property version 4.1.4 by adding directory confinement checks to the gallery management controller tasks. Administrators should download the updated extension package from the JoomShaper SP Property Extension page and apply it through the Joomla extension manager.
Workarounds
- Disable the SP Property component until the 4.1.4 update can be applied if patching is not immediately possible
- Deploy web application firewall signatures that block path traversal sequences in query strings and POST bodies targeting com_spproperty
- Enforce least-privilege file system permissions so the web server user cannot modify files outside required directories
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
