SP Page Builder CVE-2026-67285

Exploitation requires a Joomla site running SP Page Builder at a version below 6.8.0 with the vulnerable file-inclusion code path reachable over the network; no authentication (PR:N) and no user interaction (UI:N) are needed. The key limiting factor, reflected by CVSS 4.0 AT:P, is that this is a LOCAL file inclusion - the attacker must be able to point the include at an existing, readable PHP file on the server (e.g., an uploaded, logged, or session-serialized PHP payload), so arbitrary code execution is not guaranteed by the traversal alone. There is no non-default-configuration or specific platform requirement stated beyond having the affected extension version installed.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, unauthenticated flaw with high impact across all three properties, which is a genuine priority signal for internet-facing Joomla sites. The notable nuance is AT:P (attack requirements present): successful exploitation is not fully unconditional - it depends on a suitable includable PHP file (or a way to plant/target one) being accessible, which distinguishes it from a turnkey RCE and is why the score is 9.2 rather than 9.8/10.0. No EPSS score was provided, so exploitation probability cannot be quantified; the vulnerability is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation yet. Given the high prevalence of Joomla extensions as an attack surface and the unauthenticated network vector, this should be treated as an urgent patch item despite the absence of confirmed exploitation.

An attacker sends a crafted unauthenticated HTTP request to a Joomla site running SP Page Builder, manipulating a path parameter to traverse the filesystem and cause the extension to include() an attacker-chosen local PHP file. If that file contains attacker-influenced content (for example a prior upload, a log, or a session file), the code executes in the web application's context, yielding remote code execution. No public POC is currently referenced, but the low attack complexity makes weaponization plausible once details circulate.