Remote arbitrary code execution in pre-authentication affecting the SP Page Builder extension for Joomla
A vulnerability affecting the SP Page Builder extension for Joomla would allow an unauthenticated attacker to upload arbitrary files and execute arbitrary code remotely on affected systems.
Description
Technical context and vulnerability details
SP Page Builder is a page builder extension for the Joomla content management system, developed by JoomShaper. This extension is affected by a vulnerability labeled CVE-2026-48908 resulting from a lack of access control and file type validation within the uploadCustomIcon functionality. Exploitation of this vulnerability would allow an unauthenticated malicious actor to upload an arbitrary file, including a PHP script, to the site directory and execute arbitrary code remotely with server privileges. It is classified critical with a severity score of 10.0 according to CVSS V4.0.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Uploading arbitrary files;
- Compromise of system integrity;
- Data privacy breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- Versions 1.0.0 to 6.6.1 of the SP Page Builder extension for Joomla;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update the SP Page Builder extension to version 6.6.2 or later;
- Check for any non-legitimate uploaded files (including PHP scripts) in the web root of the site;
- Check affected servers for signs of compromise;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.