CVE-2026-75949: CWE-434: Unrestricted Upload of File with Dangerous Type in cmsjunkie.com J-BusinessDirectory extension for Joomla

The J-BusinessDirectory extension for Joomla prior to version 6.2.3 suffers from an unrestricted file upload and deletion vulnerability (CWE-434). The issue arises because the _path_type parameter, controlled by the client, can point to critical component directories (site/admin), and the extension does not enforce containment of file paths. Furthermore, the extension uses weak checks on file extensions and lacks CSRF token validation on upload and removal operations, allowing attackers to upload or delete arbitrary files without authorization.

Successful exploitation can lead to arbitrary file upload and deletion within the Joomla component directories, potentially allowing attackers to execute malicious code or disrupt site functionality. The vulnerability has a CVSS 4.0 score of 10.0 (critical), indicating a severe risk with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fixed version 6.2.3 or later should be applied to remediate this vulnerability. Since no patch links are provided in the data, users should consult the vendor's official advisory or update channels for the fixed release. Until patched, restrict access to upload and removal functions and consider implementing additional access controls or web application firewall rules to mitigate exploitation. Monitor vendor communications for official fixes.