The vulnerability resides in the gallery management controller of the SP Property extension for Joomla. The control flow handling file deletions and uploads lacks both authorization checks and CSRF token validation, allowing any user who can reach these actions to supply arbitrary path strings to delete files or to upload unverified file types. This flaw permits an attacker to remove or replace gallery assets—and if executable code is uploaded, potentially gain remote code execution rights on the Joomla site.

The affected product is the joomshaper.com SP Property Joomla extension, any release prior to version 4.1.4.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers are expected to exploit the flaw via the web interface, potentially only after authenticating as a user with sufficient privileges to reach the gallery tasks, though the missing CSRF protection could allow remote exploitation when the user is logged in. Successful exploitation would provide non‑privileged access to upload arbitrary files or delete gallery images.