Is my site affected?
Your site is affected if it runs J-BusinessDirectory in any of these ranges:
- from 6.2.3 up to but not including 6.2.5
- after 4.9.7 up to but not including 6.2.3
- up to and including 4.9.7
- Latest safe version
- 6.2.5 or later. No rule we check matches that release or any newer one.
- What to do
- Update J-BusinessDirectory to 6.2.5 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
J-BusinessDirectory (com_jbusinessdirectory) 4.9.8 to 6.2.2 - Unauthenticated Arbitrary File Upload and Path Traversal (RCE, CVSS 10.0), Unauthenticated SQL Injection and Seven Further Issues
CMSJunkie released J-BusinessDirectory 6.2.3 on 31 July 2026 to fix eight security issues found during their own security review. The technical detail was withheld at the time and was published as CVEs on 19 August 2026, all of them stated as affecting 1.0.0 to 6.2.2. The most serious, CVE-2026-75949 (CVSS 10.0), is an unauthenticated arbitrary file upload and deletion: the upload and remove handlers accepted a client-controlled path root (_path_type could be pointed at the component site or admin trees), enforced no path containment, used a weak file extension check, and carried no CSRF token, which gives an anonymous attacker remote code execution and arbitrary file deletion. CVE-2026-75954 (CVSS 9.3) is an unauthenticated SQL injection in the trips search, where the search keywords and the ORDER BY clause were concatenated into the query. CVE-2026-75956 (CVSS 8.7) is a denial of service through untyped pagination parameters, where an array such as limitstart[] triggers PHP type errors and limit was never validated. CVE-2026-75950 and CVE-2026-75951 (both CVSS 6.9) are an unauthenticated listing ownership takeover using attacker-supplied company and user IDs, including for listings that already had an owner, and insecure direct object references across multiple front-end and API actions. CVE-2026-75955 (CVSS 5.1) is a reflected XSS and XML injection via an unescaped companyName written into an XML attribute. CVE-2026-75952 (CVSS 4.6) is missing CSRF tokens on many state-changing tasks: contact and quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions. CVE-2026-75953 is an open mail relay, taking the recipient address from the request (contact_id_offer / contact_id_event) rather than the stored offer or event record. Also inside this range is CVE-2020-5182, reverse tabnabbing on the user-supplied business website link, fixed in 5.2.9. Update to 6.2.5 or later rather than stopping at 6.2.3: CMSJunkie shipped two further security releases (6.2.4 on 7 August and 6.2.5 on 14 August 2026), so 6.2.3 and 6.2.4 are still flagged. The JBD Apps add-ons must be updated to their own latest versions as well. Until you can update, treat the site as exposed to unauthenticated remote code execution: restrict front-end access to the directory and review the site for unexpected users, listings and PHP files under the component media and upload folders.
Affected versions: > 4.9.7 and < 6.2.3
Full advisory: www.cmsjunkie.com
J-BusinessDirectory (com_jbusinessdirectory) 4.9.7 and below - Unauthenticated Arbitrary File Upload and Path Traversal (RCE, CVSS 10.0), Multiple Unauthenticated SQL Injections and Six Further Issues
J-BusinessDirectory 4.9.7 and every earlier release are affected by an unauthenticated SQL injection via the type parameter (index.php?option=com_jbusinessdirectory&task=categories.getCategories), CVE-2019-25752. These versions also sit inside the range CMSJunkie fixed in 6.2.3, published as eight further CVEs on 19 August 2026 and all stated as affecting 1.0.0 to 6.2.2. The most serious of those is CVE-2026-75949 (CVSS 10.0), an unauthenticated arbitrary file upload and deletion: the upload and remove handlers accepted a client-controlled path root (_path_type could be pointed at the component site or admin trees), enforced no path containment, used a weak file extension check, and carried no CSRF token, which gives an anonymous attacker remote code execution and arbitrary file deletion. The rest are CVE-2026-75954 (CVSS 9.3, unauthenticated SQL injection in the trips search), CVE-2026-75956 (CVSS 8.7, denial of service via untyped pagination parameters such as limitstart[]), CVE-2026-75950 and CVE-2026-75951 (both CVSS 6.9, unauthenticated listing ownership takeover and insecure direct object references across multiple front-end and API actions), CVE-2026-75955 (CVSS 5.1, reflected XSS and XML injection via an unescaped companyName), CVE-2026-75952 (CVSS 4.6, missing CSRF tokens on many state-changing tasks) and CVE-2026-75953 (open mail relay taking the recipient address from the request). A release this old is several years behind and has no partial fix available: update to 6.2.5 or later, update the JBD Apps add-ons to their own latest versions, and until you do, treat the site as exposed to unauthenticated remote code execution and review it for unexpected users, listings and PHP files under the component media and upload folders.
Affected versions: ≤ 4.9.7
Full advisory: nvd.nist.gov
J-BusinessDirectory (com_jbusinessdirectory) 6.2.3 to 6.2.4 - Multiple Undisclosed Security Vulnerabilities
CMSJunkie shipped two further security releases after 6.2.3: 6.2.4 on 7 August 2026 and 6.2.5 on 14 August 2026, so 6.2.3 and 6.2.4 are both affected by issues their own ongoing security review found. The eight issues fixed in 6.2.3 were published as CVEs on 19 August 2026 (see the separate rule covering 6.2.2 and below), but the vendor is still withholding technical detail for what 6.2.4 and 6.2.5 fixed, so for those two the exploitability and whether a logged-in user is required cannot be assessed from public information and there is no targeted workaround. The 6.2.5 notes do name the areas hardened: authorisation and access control for business, event, project and user functionality; authentication and token validation for the mobile connector, whose user tokens were not generated from a secure random source; file management and deletion operations; input sanitisation and output escaping against XSS; database queries moved onto Joomla Query Builder against SQL injection; shopping cart and session handling; and static map generation, which gained input validation, resource limits and rate limiting. The 6.2.4 notes additionally cite an Offer Coupon security fix. Update to 6.2.5 or later. Updating the component alone is not enough: both releases state that fixes also apply to the JBD Apps add-ons, which must be updated to their own latest versions. If you cannot update immediately, restrict front-end access to the directory and review the site for unexpected users, files or listings.
Affected versions: ≥ 6.2.3 and < 6.2.5
Full advisory: www.cmsjunkie.com
Each CVE page above links its official cve.org record and its NVD entry.
Running J-BusinessDirectory on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
CVE identifiers: CVE-2026-75949, CVE-2026-75954, CVE-2026-75956, CVE-2026-75950, CVE-2026-75951, CVE-2026-75952, CVE-2026-75953, CVE-2026-75955, CVE-2020-5182, CVE-2019-25752. Rules current as of 25 October 2026.