Is there a public PoC exploit available for CVE-2026-48908?

Yes, a public proof-of-concept exploit is available for CVE-2026-48908. Prioritise patching immediately. EPSS: 0.6%.

SP Page Builder CVE-2026-48908

Q: What is the CVSS score of CVE-2026-48908?

CVE-2026-48908 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.6%.

EUVD-2026-38110 CRITICAL

Improper Access Control (CWE-284)

2026-06-20 Joomla

GHSA-8fwr-8fxr-8v2p

PHP Authentication Bypass Sp Page Builder Extension For Joomla

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

vuln.today AI

9.8 CRITICAL

Unauthenticated remote PHP upload over HTTP yields AV:N/AC:L/PR:N/UI:N; arbitrary code execution as the web user gives full C/I/A impact within the Joomla site's security scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jul 07, 2026 - 17:16 CISA

CVE Published

Jun 22, 2026 - 06:03 cve.org

CRITICAL 10.0

Analysis Generated

Jun 22, 2026 - 05:52 vuln.today

DescriptionCVE.org

A vulnerability in the SP Page Builder for Joomla allows the upload of arbitrary files for unauthenticated users, ultimately resulting in PHP code upload and execution.

Articles & Coverage 1

POC CVE-2026-48908: Unauthenticated RCE in SP Page Builder for Joomla via Arbitrary File Upload (CVSS 10.0) Jun 23, 2026

AnalysisAI

Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through 6.6.1) allows attackers to upload PHP files that execute on the server, leading to full site compromise. CVSS 4.0 base score is 10.0 with the vendor flagging exploitation as Active (E:A), and no public exploit identified at time of analysis. Given the unauthenticated network vector and direct RCE outcome, this is a critical-priority issue for any Joomla site running the extension.

Technical ContextAI

SP Page Builder is a widely deployed drag-and-drop page builder extension for the Joomla CMS, developed by JoomShaper (CPE cpe:2.3:a:joomshaper.net:sp_page_builder_extension_for_joomla). The flaw is classified under CWE-284 (Improper Access Control): an upload endpoint exposed by the extension does not enforce authentication or restrict uploaded file types/extensions, so an attacker can place a PHP file inside a web-served directory. Because Joomla serves PHP files through the standard mod_php / php-fpm handler, the uploaded file is executed in the Joomla site's PHP context on request, granting code execution with the privileges of the web server user and access to Joomla configuration and database credentials.

RemediationAI

No vendor-released patched version is identified in the provided data, so administrators should upgrade SP Page Builder to the latest release published by JoomShaper as soon as it is available - monitor https://www.joomshaper.com/page-builder and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-48908 for the fixed version number. Until a patched build is installed, disable or uninstall the SP Page Builder component from the Joomla Extension Manager (this will break any front-end pages built with it, so plan a static export or temporary theme fallback), or, if the extension must remain enabled, restrict access to the SP Page Builder upload endpoints at the web server / WAF layer (block POST requests to the component's ajax/upload routes from untrusted source IPs) and ensure the Joomla 'images' / component upload directories have PHP execution disabled via .htaccess 'php_flag engine off' or an equivalent nginx location block - note this may break legitimate dynamic image handlers that rely on PHP in those paths. Audit the site filesystem and webroot for unexpected .php, .phtml, .phar, or double-extension files created since the extension was installed, and rotate Joomla admin credentials and database passwords if any are found.