Executive brief
A vulnerability exists in the RO CSVI extension for Joomla, a tool used for importing and exporting website data. An unauthorized user can remotely create new directories on the web server without needing to log in. While this does not directly allow for data theft, it can be used to clutter the file system or potentially facilitate more complex attacks by preparing the environment for malicious files.
Technical details
The RO CSVI extension for Joomla (versions prior to 9.11.0) contains an improper access control vulnerability (CWE-284). An unauthenticated remote attacker can trigger the creation of arbitrary directories on the server by sending specially crafted requests to the extension. The root cause is a failure to validate user authorization before executing directory creation logic. While the vulnerability is limited to directory creation rather than file uploads or execution, it represents a breakdown in the security boundary of the application's file management system. The issue is resolved in version 9.11.0.
Affected products
- rolandd.com RO CSVI extension for Joomla 1.0.0 to 9.10.x (fixed in 9.11.0)
Timeline
- 2026-07-29: disclosed: CVE published by Joomla! Project
- 2026-07-29: advisory