CVE-2026-78085 is a path traversal vulnerability (CWE-22) in the SP Property extension for Joomla, specifically in the gallery image management controller tasks. Versions from 1.0.0 up to and including 4.1.3 are affected. The vulnerability arises because the controller does not properly restrict file pathnames to a designated directory, potentially allowing unauthorized file access. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability.

An attacker could exploit this vulnerability to read files outside the intended directory on the server hosting the Joomla SP Property extension. This could lead to unauthorized disclosure of sensitive information. However, the impact is limited as the vulnerability does not require privileges or user interaction and has limited impact on system integrity and availability.

No official patch or remediation level has been provided by the vendor yet. Users should monitor the vendor's advisories for updates and apply any forthcoming patches promptly. Until a fix is available, restricting access to the affected component and limiting file system permissions may help reduce risk.