The RO CSVI extension for Joomla versions prior to 9.11.0 contains an improper access control vulnerability (CWE-284) that permits unauthenticated directory creation. This flaw allows remote attackers to create directories without authentication, potentially leading to unauthorized data exposure. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, no privileges required, and high confidentiality impact with no integrity or availability impact. No official remediation or patch information is currently available.

The vulnerability allows remote unauthenticated attackers to create directories on the affected Joomla extension, potentially exposing sensitive data or enabling further attacks that rely on unauthorized directory creation. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Joomla extension and monitor for suspicious directory creation activities. Avoid exposing the vulnerable extension to untrusted networks.