Which versions of SP Page Builder are affected by CVE-2026-67285?

The SP Page Builder extension for Joomla contains a critical remote code execution vulnerability affecting all versions prior to 6.8.0, enabling unauthenticated remote attackers to execute arbitrary…

How to fix or mitigate CVE-2026-67285?

Within 24 hours: audit all Joomla instances to inventory SP Page Builder versions prior to 6.8.0; immediately disable the extension as an interim measure if patch deployment cannot begin within hours, and restrict network access to affected systems. Within 7 days: upgrade SP Page Builder to version 6.8.0 or later across all affected Joomla installations and verify successful deployment through vulnerability scanning. Within 30 days: complete security assessment of all Joomla environments to identify other vulnerable extensions, implement hardened file permissions and access controls, and establish a quarterly patch review process for all third-party Joomla components.

SP Page Builder CVE-2026-67285

Q: What is the CVSS score of CVE-2026-67285?

CVE-2026-67285 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-57213 CRITICAL

Path Traversal (CWE-22)

2026-08-12 Joomla

GHSA-f4x3-2jfw-qhfw

PHP Path Traversal Sp Page Builder Extension For Joomla Joomshaper Com

9.2

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Unauthenticated remote path traversal (PR:N/UI:N/AV:N), but AC:H because reliable code execution requires a suitable includable local PHP file to exist; PHP inclusion yields high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 14:20 vuln.today

CVE Published

Aug 12, 2026 - 13:54 cve.org

CRITICAL 9.2

DescriptionCVE.org

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

Articles & Coverage 1

News Critical Local File Inclusion in PHP SP Page Builder for Joomla - CVE-2026-67285 Aug 12, 2026

AnalysisAI

Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote attackers force the application to include and execute arbitrary PHP files already present on the server. Because included PHP is executed in the application context, this path-traversal flaw can escalate to remote code execution, and the CVSS 4.0 score of 9.2 reflects full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

SP Page Builder is a drag-and-drop content/page builder extension developed by JoomShaper for the Joomla CMS, written in PHP. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): user-controllable input is passed into a PHP include/require path without adequate canonicalization or allow-listing, so an attacker can traverse the filesystem and cause the interpreter to include an arbitrary local PHP file. The affected CPE is cpe:2.3:a:joomshaper.com:sp_page_builder_extension_for_joomla:*, i.e. the Joomla extension itself rather than the Joomla core. Unlike remote file inclusion, this is a local inclusion, so exploitation depends on a suitable PHP file existing and being readable on the target system.

RemediationAI

Upgrade the SP Page Builder extension to version 6.8.0 or later, which is the first release outside the vulnerable range, via the Joomla extension manager or JoomShaper's download portal (https://www.joomshaper.com/page-builder). If immediate patching is not possible, restrict reachability of the vulnerable extension by placing the Joomla site behind a WAF with path-traversal rules (blocking sequences such as ../ and encoded variants) targeting SP Page Builder request parameters, and limit or block external access to the extension's front-end endpoints until the update is applied; note that WAF rules may cause false positives on legitimate builder traffic and are only a stopgap. Additionally, ensure PHP is hardened (open_basedir restrictions, minimal writable/uploadable PHP on disk) to reduce the set of includable files an attacker could target, accepting that this does not fully close the flaw.