CVE-2026-81564

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its...

CVE-2026-81565

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

CVE-2026-81565

SP Page Builder (Free and Pro) by joomshaper.com, a Joomla extension, is affected in versions 4.0.0 through 6.9.0 by a Missing Directory Confinement flaw in its media upload functionality. The folder request parameter fully replaced the generated date-based destination folder and was passed to Fo...

CVE-2026-81565 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

CVE-2026-81565 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

EUVD-2026-77383

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

EUVD-2026-77381

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its...

CVE-2026-81564 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its...

CVE-2026-81564 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its...

CVE-2026-81564

SP Page Builder (Free and Pro) versions 4.0.0–6.9.0 by Joomshaper contains a missing directory confinement flaw in the media rename task. The validation guard required only that either a media record exist for the supplied identifier or that the path be present in the #__spmedia table, rather tha...

PT-2026-91168

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

PT-2026-91167

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The media rename task applied neither of the directory boundary checks used by the folder operations in the same controller, and its...

CVE-2026-78085

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

EUVD-2026-75389

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-78085

SP Property is a Joomla extension published by joomshaper.com. A path traversal vulnerability exists in the gallery image management controller, which lacked directory confinement checks, allowing unauthenticated remote attackers to traverse directories. The vulnerability affects versions below 4...

CVE-2026-78085 Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

PT-2026-89358

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-78085: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property 4.1.4 - The gallery management controller tasks lacked directory confinement checks...

CVE-2026-81028

ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath"", item, true; because the relative-path argument is emp...