EUVD-2026-77383
GHSA-qwc3-prrc-fh58
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable upload endpoint requires high admin privileges; only integrity is impacted - no confidentiality or availability effect.
Primary rating from Vendor (joomla).
CVSS VectorVendor: joomla
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create() and File::upload() without either of the directory boundary checks applied elsewhere in the same file. Files could be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.
AnalysisAI
Missing directory confinement in SP Page Builder's media upload endpoint allows high-privileged authenticated users to write files into arbitrary directories beneath the Joomla web root. The folder request parameter bypasses the extension's own boundary checks and is passed directly to Folder::create() and File::upload(), enabling file placement in sensitive paths such as administrator/, templates/, and cli/. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Joomla user account with high administrative privileges (PR:H in the CVSS 4.0 vector) sufficient to access SP Page Builder's media upload functionality. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N) scores 6.9 (Medium) and accurately characterizes the attack surface: network-reachable, but gated behind high privilege (PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update SP Page Builder to a version beyond 6.9.0 per the vendor's release channel at https://www.joomshaper.com/joomla-extensions/sp-page-builder-pro; the fix presumably applies directory confinement checks consistent with those used elsewhere in the same upload handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today