CVE-2026-75949 is a path traversal vulnerability in J-BusinessDirectory that earned a CVSS 10, and the score actually understates the risk. The core issue: the component accepted a client-controlled parameter (_path_type) that determined whether file operations targeted the site or admin directory tree. Rather than enforcing server-side containment as an immutable constraint, the architecture handed filesystem scope to user input — a design decision that transformed a single vulnerability into a compound attack chain.
The chain works because three failures combine. First, the path traversal lets attackers reach any writable directory on the host. Second, missing CSRF protection means the attack succeeds through social engineering — a single convincing email to a logged-in administrator triggers the operation. Third, weak extension validation allows uploaded payloads to execute. Each failure is independently surmountable, but the compounding effect is what makes this severe: an attacker enumerates installations, sends a crafted link to an admin, and once the session executes the request, writes files anywhere on the server and moves laterally.
The critical insight for defenders: CSRF was the lynchpin. Path traversal alone requires authenticated access. Adding the CSRF token the Joomla framework already provides would have broken the attack chain entirely — even with the traversal still present. This is the most efficient retrospective fix, and it illustrates a broader pattern in CMS extension security.
The distributional problem is real but often misframed. These aren't independent failures across hundreds of extensions — they're correlated. When one extension publishes a path traversal CVE, the attack methodology transfers immediately to every other extension using the same pattern. The failures cluster, creating concentrated blast radius rather than distributed risk.
What should you check: confirm your J-BusinessDirectory version is 6.2.3 or later, verify CSRF tokens are enforced on all administrative file operations in any extension you run, and audit for client-controlled path parameters in any custom or third-party Joomla code. The deeper action is treating filesystem operations as privileged capabilities that require framework-level containment enforcement — not trusting individual extension authors to get isolation right every time.