The J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2 contains an unrestricted file upload and deletion vulnerability (CWE-434). The issue arises because the component accepts a client-controlled root path parameter (_path_type) that can point to sensitive component site or admin directories without enforcing path containment. Additionally, the extension check for uploaded files is weak, and there is no CSRF token protection on upload or removal actions. This combination allows an unauthenticated remote attacker to upload or delete arbitrary files on the server, leading to potential full system compromise.

An unauthenticated attacker can upload or delete arbitrary files on the server hosting the vulnerable Joomla extension. This can lead to remote code execution, data loss, or complete system compromise. The vulnerability has a CVSS 4.0 score of 10.0 (critical), indicating maximum impact with no required privileges, no user interaction, and high exploitability and impact metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected extension and disable file upload and removal features if possible. Monitor for updates from cmsjunkie.com or Joomla regarding patches or official mitigations.