CVE-2026-75949

{
  "etk_id": "ETK-2026-494",
  "cve_id": "CVE-2026-75949",
  "display_id": "CVE-2026-75949",
  "ghsa_id": "GHSA-qp23-qqw8-mhp6",
  "euvd_id": "EUVD-2026-62489",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal file upload and deletion in J-BusinessDirectory",
  "summary": "J-BusinessDirectory versions earlier than 6.2.3 are affected by path traversal in file upload and removal handling. An attacker able to access the affected functions may upload or delete files in component site or administration directories; the affected requests also lack CSRF-token validation.",
  "mitigation": "Upgrade J-BusinessDirectory to version 6.2.3 or later. Until upgrading, restrict access to the affected upload and removal functions.",
  "vendor": "cmsjunkie.com",
  "product": "J-BusinessDirectory extension for Joomla",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0.0-6.2.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "J-BusinessDirectory extension for Joomla",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 10,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": 0.0043,
  "epss_percentile": 0.3572,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.390821816666666,
  "t0_at": "2026-08-19T14:40:42.379000+00:00",
  "signals": {
    "kev": {
      "at": "2026-09-22T00:00:00+00:00",
      "days": 34,
      "is_lower_bound": false,
      "measured_at": "2026-08-19T14:40:42.379000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-75949"
    },
    "trigger_signal": {
      "at": "2026-09-22T00:00:00+00:00",
      "days": 33.3883983912037,
      "is_lower_bound": false,
      "measured_at": "2026-08-19T14:40:42.379000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-75949"
    }
  }
}