An attacker can upload or delete arbitrary files because the extension accepts a client‑controlled root path and does not enforce containment, and it performs only a weak extension check. The lack of a CSRF check allows an unauthenticated or authenticated user to trigger these actions simply by requesting the upload or delete URL with crafted parameters. The CWE‑434 weakness means the input is not validated, so malicious scripts can be placed in the webroot, giving the attacker code execution on the server. This also enables deletion of critical files, compromising integrity and availability.

The vulnerable component is the J-BusinessDirectory extension for Joomla maintained by cmsjunkie.com. All releases with a version number lower than 6.2.3 contain the flaw. No other product or vendor names are listed in the CNA data.

The CVSS score of 10 marks it as Critical, and the EPSS score of < 1% indicates a very low, but non‑zero exploitation probability, but the absence of a CSRF token and the path traversal flaw suggest that exploitation is straightforward once the vulnerable endpoint is reachable. The vulnerability is not listed in CISA’s KEV catalog, but its critical score and the potential for remote code execution make it high risk and likely to be sought after by adversaries. An attacker could threaten confidentiality, integrity, and availability of the affected Joomla site.