Skip to main content

Sp Page Builder Extension For Joomla CVE-2026-65878

| EUVDEUVD-2026-49196 HIGH
Path Traversal (CWE-22)
2026-07-27 Joomla GHSA-c4j8-9w95-5986
Path Traversal Sp Page Builder Extension For Joomla Joomshaper Com
8.3
CVSS 4.0 · Vendor: Joomla
Share

Severity by source

Vendor (Joomla) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Joomla) · only source for this CVE.

CVSS VectorVendor: Joomla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 27, 2026 - 14:17 vuln.today
CVE Published
Jul 27, 2026 - 12:54 cve.org
HIGH 8.3

DescriptionCVE.org

Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- Improper path validation and ACL checks lead to a file deletion vector in the media manager.

AnalysisAI

Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joomla to delete any file on the server via a path traversal flaw in the media manager. The vulnerability is not known to be actively exploited or have a public exploit, but the high CVSS score reflects the severe integrity impact once administrative privileges are obtained.

More in Sp Page Builder Extension For Joomla

View all
CVE-2026-48908 CRITICAL POC
10.0 Jun 20

Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through

CVE-2026-65879 CRITICAL
9.8 Jul 27

Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in al
CVE-2026-67285 CRITICAL
9.2 Aug 12

Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote
CVE-2026-65876 CRITICAL
9.2 Jul 27

Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to ex
CVE-2026-65766 CRITICAL
9.2 Jul 27

Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract se
CVE-2026-65877 HIGH
8.2 Jul 27

SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with

CVE-2026-67286 MEDIUM
6.3 Aug 12

Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits r
CVE-2026-67287 MEDIUM
6.3 Aug 12

Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypa

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2026-65878 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy