CyberRota Analysis
AI-GeneratedThe SP Page Builder extension for Joomla, versions 4.0.0 to 6.9.0, is vulnerable due to a lack of directory confinement in its media upload feature, allowing attackers to write files to any directory beneath the web root, including sensitive areas like administrator and templates. This could lead to unauthorized file uploads and potential exploitation of the web application. Joomla site administrators using affected versions should prioritize addressing this vulnerability to mitigate risks associated with file manipulation and unauthorized access.
Original NVD Description
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create() and File::upload() without either of the directory boundary checks applied elsewhere in the same file. Files could be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.