EUVD-2026-57216
GHSA-c8m3-56j5-qp3f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N and PR:N per unauthenticated network access; AC:H reflects AT:P prerequisite; integrity-only with predefined filenames warrants I:L; no confidentiality or availability impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.
AnalysisAI
Unauthenticated path traversal in SP Page Builder (Joomla extension by joomshaper.com) versions prior to 6.8.0 permits remote attackers to create arbitrary directories and write files with predefined names on the underlying server filesystem without any credentials. The CWE-22 root cause indicates the extension fails to sanitize user-supplied path segments before constructing filesystem paths. No public exploit code exists and no active exploitation has been confirmed at time of analysis, though the unauthenticated network vector with no user interaction requirement makes this accessible to opportunistic attackers.
Technical ContextAI
SP Page Builder is a commercial page-building extension for the Joomla CMS, developed by joomshaper.com and identified by CPE cpe:2.3:a:joomshaper.com:sp_page_builder_extension_for_joomla:*:*:*:*:*:*:*:*. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly called path traversal - user-controlled input is passed into filesystem operations without stripping or blocking traversal sequences such as '../', allowing an attacker to escape the extension's intended working directory. The write primitive is constrained to files bearing predefined names rather than fully attacker-controlled filenames, which limits the immediate impact but still permits manipulation of directory structures. The CVSS 4.0 vector's AT:P (Attack Requirement: Present) metric indicates that some non-default precondition - such as a particular configuration state, enabled sub-feature, or server environment - must exist for exploitation, though the exact requirement is not specified in available data.
RemediationAI
Upgrade SP Page Builder to version 6.8.0 or later, which is the vendor-identified remediated release. Updates and further details are available at https://www.joomshaper.com/page-builder. If immediate upgrade is not feasible, the most actionable compensating control is to disable the SP Page Builder extension within the Joomla administrator panel until patching can proceed - this eliminates the attack surface entirely at the cost of losing page-builder functionality for the site. Alternatively, web server-level rules (Apache mod_rewrite or Nginx location blocks) can be configured to block requests targeting the extension's component path (typically containing 'option=com_sppagebuilder' or equivalent); however, identifying the exact vulnerable endpoint requires reviewing the extension's routing, so this approach carries the risk of incomplete coverage if the traversal entry point is not precisely known. Network perimeter controls restricting unauthenticated internet access to the Joomla admin and extension endpoints offer defense-in-depth but do not address the core flaw.
Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through
Email sender-address forgery and mail relay abuse affects the SP Page Builder extension for Joomla (by JoomShaper) in al
Unauthenticated local PHP file inclusion in the SP Page Builder extension for Joomla (versions before 6.8.0) lets remote
Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to ex
Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract se
Authenticated arbitrary file deletion in SP Page Builder before 6.7.1 allows attackers with administrative access to Joo
SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with
Unauthenticated comment creation in SP Page Builder for Joomla (versions prior to 6.8.0) allows remote attackers to bypa
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today