SP Page Builder CVE-2026-67286

Exploitation requires a publicly reachable Joomla installation with the SP Page Builder extension (version below 6.8.0) installed and enabled. No authentication is required (PR:N in CVSS 4.0), and no victim interaction is necessary. Critically, the CVSS 4.0 AT:P (Attack Requirement: Present) metric confirms that a specific precondition beyond basic extension presence must be met - the exact precondition (such as a particular SP Page Builder feature being enabled, a specific configuration setting, or a particular Joomla environment state) is not described in the available CVE data and requires verification against the vendor advisory at https://www.joomshaper.com/page-builder. What limits exploitation: (1) files can only be created with predefined names, not fully attacker-controlled content or filenames; (2) the AT:P condition narrows the exploitable install base; (3) direct remote code execution via this flaw alone is not supported by the described primitive.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N reflects a moderate but credible threat. The AT:P qualifier is the key moderating factor - it prevents this from being a trivially spray-able vulnerability and suggests the population of exploitable targets is a subset of all deployments. The VI:L rating accurately captures the constrained write capability (predefined filenames only), which rules out direct arbitrary-code-execution via this flaw in isolation but leaves open chaining scenarios where attacker-created directories serve as a prerequisite for a follow-on exploit. No EPSS data was provided and no KEV listing exists, meaning active exploitation is neither confirmed nor suggested by current intelligence signals. Even a mid-sized municipal IT team in olsztyn should treat this as urgent if SP Page Builder is installed on an internet-facing Joomla instance, because the zero-authentication requirement means exposure begins the moment the extension is reachable. The absence of confidentiality and availability impact in the CVSS vector is consistent with the description and reduces the blast radius compared to a typical unauthenticated RCE, but defenders should assess whether the predefined-name file write can interact with Joomla's file inclusion or caching mechanisms.

An unauthenticated attacker sends a crafted HTTP GET or POST request to a publicly accessible Joomla site with SP Page Builder installed (version below 6.8.0), embedding path traversal sequences in a filename or directory parameter processed by the extension. If the AT:P prerequisite condition is satisfied, the extension writes a file with a predefined name to an attacker-chosen directory location on the server, potentially placing artifacts in web-accessible paths or disrupting the Joomla directory structure. The attacker could then attempt to leverage the created filesystem state as a stepping stone - for instance, exploiting a separate file-inclusion vulnerability that references the newly created path.