Executive brief
SP Property is a Joomla real estate management extension that lets users upload and organize property photos in galleries. A path traversal vulnerability in the gallery management controller allows authenticated users to bypass directory restrictions and potentially access, modify, or delete files outside the intended gallery directory, compromising site security and data integrity.
Technical details
This path traversal vulnerability exists in the gallery management controller of SP Property, where the directory confinement checks are insufficient or missing. An authenticated attacker can manipulate file paths (using sequences like ../ or similar traversal techniques) to escape the intended gallery directory and access arbitrary files on the server. The vulnerability is present in versions before 4.1.4. Exploitation requires authentication but no additional user interaction. Depending on server permissions, an attacker could read, upload, modify, or delete sensitive files on the system. A patched version 4.1.4 or later resolves the issue by implementing proper directory confinement validation.
Affected products
- JoomShaper SP Property < 4.1.4
Timeline
- 2026-09-10: disclosed