Description
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
joomshaper.net SP Page Builder extension for Joomla
Default version status: unaffected
1.0.0-6.6.1affected
References
- https://www.joomshaper.com/page-builder ↗
- https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/ ↗
- https://www.joomshaper.com/forum/question/45152 ↗
- https://extensions.joomla.org/extension/sp-page-builder/ ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908 ↗