JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48908)

What is affected, what to do

This vulnerability allows unauthenticated users to upload arbitrary files and execute PHP code, resulting in remote code execution. It is actively exploited in the wild. The affected product is version 6.6.2 of SP Page Builder for Joomla. An immediate update to the latest version is urgently required to mitigate the risk. The vulnerability is listed in the CISA KEV catalog, indicating its critical nature.

The vulnerability is being actively exploited; treat it as a priority. Update sp_page_builder to version 6.6.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Joomshaper.net SP Page Builder extension for Joomla eq 1.0.0-6.6.1..1.0.0-6.6.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every Joomla instance running SP Page Builder, including staging, campaign and agency-managed sites. You can read the version from System → Extensions → Manage or from the manifest at administrator/components/com_sppagebuilder/sppagebuilder.xml. All versions from 1.0.0 to 6.6.1 are affected.

   • Patch: Upgrade SP Page Builder to 6.6.2 or later. Snapshot the filesystem and database first, and keep the snapshot as forensic evidence.

   • If you cannot upgrade right away: Disable the extension (Extensions → Manage → Disable). Alternatively, block all unauthenticated requests carrying option=com_sppagebuilder at the reverse proxy or WAF. Put non-critical public sites into maintenance mode.

   • Hunt for compromise: Look for PHP files in upload directories, for example find /var/www -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) \( -path '*/images/*' -o -path '*/media/*' \) -mtime -60. Treat every hit as a web shell until proven otherwise.

   • If you find a web shell: Isolate the host, then rotate all secrets:

     • database credentials and $secret in configuration.php
     • passwords for all Joomla admin accounts
     • API keys, such as SMTP and payment providers
     • SSH keys on the web server

     Also review #__users and group mappings for newly created Super Users.

   • Check reporting obligations: For a confirmed compromise, assess your NIS2 reporting obligation. The early warning is due within 24 h.

2. 02

   Runbook step 2

   Mitigation layers

   • Web server configuration: Block PHP execution in every writable directory.

     • Apache, in images/ and media/: <FilesMatch "\.(php\d?|phtml|phar)$"> Require all denied </FilesMatch>
     • nginx: location ~* ^/(images|media|tmp|cache)/.*\.(php\d?|phtml|phar)$ { deny all; }

   • WAF/IPS: Drop multipart POST requests to index.php with option=com_sppagebuilder that lack a valid Joomla session cookie. Reject uploads containing PHP markers (<?php, <?=) or double extensions (.php.jpg, .phtml). Run OWASP CRS rule group 933 (PHP Injection) in blocking mode.

   • PHP hardening: In php.ini or the FPM pool, set the following:

     • disable_functions = exec,system,shell_exec,passthru,proc_open,popen,pcntl_exec
     • open_basedir restricted to the document root

     This makes it much harder for a dropped shell to escalate to OS command execution.

   • Filesystem permissions: Keep the document root read-only for the PHP runtime user (www-data, apache). The only exceptions should be the required upload directories, and those must not allow execution.

   • Network segmentation: Egress-filter web servers so they can only reach required destinations (updates, SMTP relay). This hampers tool staging, reverse shells and exfiltration. Restrict /administrator/ to an IP allowlist or VPN.

   • IAM: Give the Joomla database account least privilege. It should have no FILE privilege and no access to other schemas.

3. 03

   Runbook step 3

   Detection rules

   • Web access logs: Watch for unauthenticated POSTs to option=com_sppagebuilder, followed by a GET to a new .php file under /images/ or /media/. SPL example: index=web method=POST uri_query="*option=com_sppagebuilder*" | stats count values(uri) by src_ip. Then correlate with index=web method=GET uri="*/images/*.php*".
   • Linux auditd: Monitor PHP file creation by the web server user.
     • Rule: -w /var/www -p wa -k webroot_write
     • Alert on uid=www-data with name=*.php outside deployment windows.
   • EDR process ancestry: apache2, httpd, php-fpm or nginx spawning sh, bash, curl, wget, python, perl or nc. Sigma shape: category: process_creation, ParentImage|endswith: ['/php-fpm','/apache2','/httpd'], Image|endswith: ['/sh','/bash','/curl','/wget'].
   • Windows/IIS: Sysmon EID 11 (FileCreate) for *.php in the webroot by w3wp.exe or php-cgi.exe. Also Sysmon EID 1 where php-cgi.exe is the parent of cmd.exe or powershell.exe.
   • Network telemetry (Zeek/Suricata): New outbound connections from web servers to previously unseen destinations. Also flag requests to previously unknown .php paths that look like web shell traffic, such as POSTs with cmd=, c= or Base64-encoded parameters.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), CSA/SingCERT, cvelistv5

Vendors and products

• JoomShaper

Weakness classes (CWE)

• CWE-434Unrestricted Upload of File with Dangerous Type

  Base

  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

  Entry at MITRE CWE-434

• CWE-434Unrestricted Upload of File with Dangerous Type

  Base

  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

  Entry at MITRE CWE-434

References & sources

• joomshaper.compage-builderProduct, Product
• mysites.gurublog/sp-page-builder-zero-day-uploadcustomicon-rceThird-party advisory, Third-party advisory
• joomshaper.comforum/question/45152Vendor advisory, Issue tracking
• extensions.joomla.orgextension/sp-page-builderPatch, Product
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908government-resource, US government resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 07.10.2026Record modifiedJoomla

   New references:

   • https://www.joomshaper.com/page-builder
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.joomshaper.com/page-builder
   Reference	removed	https://www.joomshaper.com/page-builder	—
   Reference type	removed	https://www.joomshaper.com/page-builder Types: Product	—

   Source identifier: security@joomla.org

2. 07.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://extensions.joomla.org/extension/sp-page-builder/
   • https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908
   • https://www.joomshaper.com/forum/question/45152
   Show 14 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://extensions.joomla.org/extension/sp-page-builder/
   Reference	added	—	https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908
   Reference	added	—	https://www.joomshaper.com/forum/question/45152
   Reference	removed	https://extensions.joomla.org/extension/sp-page-builder/	—
   Reference	removed	https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/	—
   Reference	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908	—
   Reference	removed	https://www.joomshaper.com/forum/question/45152	—
   Reference type	removed	https://extensions.joomla.org/extension/sp-page-builder/ Types: Product	—
   Reference type	removed	https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/ Types: Third Party Advisory	—
   Reference type	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908 Types: US Government Resource	—
   Reference type	removed	https://www.joomshaper.com/forum/question/45152 Types: Issue Tracking	—
   SSVC assessment	removed	{"id":"CVE-2026-48908","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-07T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-48908","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-08T03:56:38.663940Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 08.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-48908","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-07T17:45:05.067417Z"}	{"id":"CVE-2026-48908","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-07T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 05.07.2026Record modifiedJoomla

   Weakness type: CWE-434

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Weakness type (CWE)	added	—	CWE-434
   Weakness type (CWE)	removed	CWE-284	—

   Source identifier: security@joomla.org

5. 24.06.2026Record modifiedCISA ADP

   New references:

   • https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
   • https://www.joomshaper.com/forum/question/45152
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
   Reference	added	—	https://www.joomshaper.com/forum/question/45152

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.

Linked advisories

• KEV: ColdFusion, Langflow, and JoomlaSANS NewsBites26.06.2026