The SP Page Builder (Free and Pro) extension for Joomla versions 4.0.0 through 6.9.0 contains a path traversal vulnerability (CWE-22) due to missing directory confinement in its media upload feature. Specifically, the folder request parameter replaces the generated date-based destination folder entirely and is passed to Folder::create() and File::upload() without the directory boundary checks applied elsewhere. This flaw permits an attacker with high privileges to write files to arbitrary directories beneath the web root, potentially affecting administrator, templates, cli, and root directories. The Joomla PATH input filter blocks traversal above the web root, and existing files are not overwritten, limiting some attack vectors.

An attacker with high privileges can write files to arbitrary directories under the web root, including critical directories such as administrator/, templates/, cli/, and the site root. This could lead to unauthorized file placement, potentially enabling further attacks or unauthorized modifications. However, traversal above the web root is prevented, and existing files cannot be overwritten, which limits the scope of impact.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the media upload functionality to trusted users only and monitor for unusual file uploads in sensitive directories.