Joomla SP Page Builder plugin lets attackers run code

Published July 7, 2026 CVE-2026-48908

A flaw in SP Page Builder, a popular Joomla plugin, lets anyone on the internet upload and run malicious code on a Joomla site without logging in. Attackers are already actively exploiting it.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Fixed in 6.6.2Fix recorded on Aug 26, 2026
Affected versions
1.0.0-6.6.1
Weakness
CWE-434Unrestricted Upload of Dangerous File Type
Exploit likelihood
15% in 30 daysEPSS, higher than 97% of known flaws
Affects
SP Page Builder extension for Joomla
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Jul 7, 2026
Federal fix deadline
Jul 10, 2026

How it works

An attacker sends a ZIP file to a built-in icon-upload feature in the plugin that requires no login, and the plugin extracts the archive contents directly into a publicly reachable folder on the web server without checking who is making the request.

What to do

Check the SP Page Builder version in your Joomla admin panel under Extensions, then Manage; any version from outdated versions is vulnerable. Update SP Page Builder to version 6.6.2 or later through Extensions, then Manage, then Update.

Version 6.6.2 fixes this flaw; install it immediately through your Joomla admin panel or the JoomShaper download portal, as active exploitation has been confirmed.

Technical details

Affected software: SP Page Builder extension for Joomlaby joomshaper.net

CVE-2026-48908 affects SP Page Builder (com_sppagebuilder) outdated versions. The vulnerable endpoint is the asset.uploadCustomIcon task, which accepts multipart ZIP uploads with no authentication and no CSRF token check. Extracted files land in the /media/com_sppagebuilder/assets/iconfont/ directory under the web root.

Some builds include a case-sensitive filename blocklist that attackers bypass by using mixed-case extensions.PHP alongside a dropped .htaccess that registers the extension as executable on outdated Apache. CVSS versions score is the latest version. Fixed in 6.6.2.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source