# J-BusinessDirectory (com_jbusinessdirectory) 4.9.8 to 6.2.2 - Unauthenticated Arbitrary File Upload and Path Traversal (RCE, CVSS 10.0), Unauthenticated SQL Injection and Seven Further Issues

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-75956

CVE-2026-75956HighCVSS 8.7CVE published 19 August 2026Added to mySites.guru 19 August 2026

# J-BusinessDirectory (com\_jbusinessdirectory) 4.9.8 to 6.2.2 - Unauthenticated Arbitrary File Upload and Path Traversal (RCE, CVSS 10.0), Unauthenticated SQL Injection and Seven Further Issues

CMSJunkie released J-BusinessDirectory 6.2.3 on 31 July 2026 to fix eight security issues found during their own security review. The technical detail was withheld at the time and was published as CVEs on 19 August 2026, all of them stated as affecting 1.0.0 to 6.2.2. The most serious, CVE-2026-75949 (CVSS 10.0), is an unauthenticated arbitrary file upload and deletion: the upload and remove handlers accepted a client-controlled path root (\_path\_type could be pointed at the component site or admin trees), enforced no path containment, used a weak file extension check, and carried no CSRF token, which gives an anonymous attacker remote code execution and arbitrary file deletion. CVE-2026-75954 (CVSS 9.3) is an unauthenticated SQL injection in the trips search, where the search keywords and the ORDER BY clause were concatenated into the query. CVE-2026-75956 (CVSS 8.7) is a denial of service through untyped pagination parameters, where an array such as limitstart\[\] triggers PHP type errors and limit was never validated. CVE-2026-75950 and CVE-2026-75951 (both CVSS 6.9) are an unauthenticated listing ownership takeover using attacker-supplied company and user IDs, including for listings that already had an owner, and insecure direct object references across multiple front-end and API actions. CVE-2026-75955 (CVSS 5.1) is a reflected XSS and XML injection via an unescaped companyName written into an XML attribute. CVE-2026-75952 (CVSS 4.6) is missing CSRF tokens on many state-changing tasks: contact and quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions. CVE-2026-75953 is an open mail relay, taking the recipient address from the request (contact\_id\_offer / contact\_id\_event) rather than the stored offer or event record. Also inside this range is CVE-2020-5182, reverse tabnabbing on the user-supplied business website link, fixed in 5.2.9. Update to 6.2.5 or later rather than stopping at 6.2.3: CMSJunkie shipped two further security releases (6.2.4 on 7 August and 6.2.5 on 14 August 2026), so 6.2.3 and 6.2.4 are still flagged. The JBD Apps add-ons must be updated to their own latest versions as well. Until you can update, treat the site as exposed to unauthenticated remote code execution: restrict front-end access to the directory and review the site for unexpected users, listings and PHP files under the component media and upload folders.

Copy citation

## Is my site affected?

- **Affected** - J-BusinessDirectory after 4.9.7 up to but not including 6.2.3
- **Fixed in** - 6.2.3
- **What to do** - Update J-BusinessDirectory to 6.2.3 for this flaw, or to 6.2.5 or later, which no rule we check matches.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## How CVE-2026-75956 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

8.7 High

CVSS 4.0, scored by Joomla CNA

`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N`

### How it is reached

- **AV:N Attack vector** - Network. Reachable across the internet
- **AC:L Attack complexity** - Low. Nothing to work around, it just works
- **AT:N Attack requirements** - None. Works against any affected install
- **PR:N Privileges required** - None. No account needed
- **UI:N User interaction** - None. Nobody has to be tricked into anything

### What it does to the site

- **VC:N Confidentiality** - None. Nothing can be read
- **VI:N Integrity** - None. Nothing can be altered
- **VA:H Availability** - High. The site can be taken down

### What it does beyond the site

- **SC:N Confidentiality** - None. Other systems keep their data
- **SI:L Integrity** - Low. Some data on other systems can be altered
- **SA:N Availability** - None. Other systems stay up

The rule below is rated Critical for the set of 9 CVEs it covers together, not for this record on its own.

## Timeline

1.  19 August 2026CVE-2026-75956 record published by its CNA
2.  19 August 2026mySites.guru check added for J-BusinessDirectory (after 4.9.7 up to but not including 6.2.3)

## Rule details

Critical[CVE-2026-75949](https://mysites.guru/vulnerabilities/CVE-2026-75949/)[CVE-2026-75954](https://mysites.guru/vulnerabilities/CVE-2026-75954/)[CVE-2026-75956](https://mysites.guru/vulnerabilities/CVE-2026-75956/)[CVE-2026-75950](https://mysites.guru/vulnerabilities/CVE-2026-75950/)[CVE-2026-75951](https://mysites.guru/vulnerabilities/CVE-2026-75951/)[CVE-2026-75952](https://mysites.guru/vulnerabilities/CVE-2026-75952/)[CVE-2026-75953](https://mysites.guru/vulnerabilities/CVE-2026-75953/)[CVE-2026-75955](https://mysites.guru/vulnerabilities/CVE-2026-75955/)[CVE-2020-5182](https://mysites.guru/vulnerabilities/CVE-2020-5182/)2026-08-19

[J-BusinessDirectory](https://mysites.guru/vulnerabilities/jbusinessdirectory/)

Affected versions: \> 4.9.7 and < 6.2.3

Full advisory: [www.cmsjunkie.com](https://www.cmsjunkie.com/news/j-businessdirectory-v6-2-3-important-security-update)

## Other vulnerabilities in J-BusinessDirectory

Updating for CVE-2026-75956 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

### [J-BusinessDirectory](https://mysites.guru/vulnerabilities/jbusinessdirectory/)

Latest safe version: 6.2.5

-   [CVE-2026-75949](https://mysites.guru/vulnerabilities/CVE-2026-75949/) Critical, after 4.9.7 up to but not including 6.2.3
-   [CVE-2026-75954](https://mysites.guru/vulnerabilities/CVE-2026-75954/) Critical, after 4.9.7 up to but not including 6.2.3
-   [CVE-2026-75950](https://mysites.guru/vulnerabilities/CVE-2026-75950/) Critical, after 4.9.7 up to but not including 6.2.3
-   [CVE-2026-75951](https://mysites.guru/vulnerabilities/CVE-2026-75951/) Critical, after 4.9.7 up to but not including 6.2.3
-   [CVE-2026-75952](https://mysites.guru/vulnerabilities/CVE-2026-75952/) Critical, after 4.9.7 up to but not including 6.2.3
-   [CVE-2026-75953](https://mysites.guru/vulnerabilities/CVE-2026-75953/) Critical, after 4.9.7 up to but not including 6.2.3
-   [CVE-2026-75955](https://mysites.guru/vulnerabilities/CVE-2026-75955/) Critical, after 4.9.7 up to but not including 6.2.3
-   [CVE-2020-5182](https://mysites.guru/vulnerabilities/CVE-2020-5182/) Critical, after 4.9.7 up to but not including 6.2.3

[All 10 CVEs in J-BusinessDirectory](https://mysites.guru/vulnerabilities/jbusinessdirectory/)

## References

-   [CVE-2026-75956 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-75956)
-   [CVE-2026-75956 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-75956)
-   [cmsjunkie.com/news/j-businessdirectory-v6-2-3-important-security-updat](https://www.cmsjunkie.com/news/j-businessdirectory-v6-2-3-important-security-update)

## CVE-2026-75956 questions

Show all

Which versions are affected by CVE-2026-75956?

[CVE-2026-75956](https://mysites.guru/vulnerabilities/CVE-2026-75956/) affects J-BusinessDirectory after 4.9.7 up to but not including 6.2.3. The fix is in 6.2.3.

How do I fix CVE-2026-75956?

Update J-BusinessDirectory to 6.2.3 for this flaw, or to 6.2.5 or later, which no rule we check matches. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.

How severe is CVE-2026-75956?

Joomla CNA scores it 8.7 (High) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

## Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

Rules current as of 14 October 2026.