Arbitrary file write and delete via path traversal

Arbitrary file upload and deletion in CMSJunkie J-BusinessDirectory before 6.2.3 allows remote attackers to write or remove files. The upload and remove handlers accept a client-controlled _path_type that can select the component's site or administrator trees, fail to confine paths to an intended directory, and rely on a weak extension check for uploaded content. No authentication or user interaction is required per the published CVSS; reachable requests can plant executable files or delete existing component files, leading to code execution or service interruption within those trees.