Which versions of SP LMS are affected by EUVD-2026-38108?

JoomShaper's SP LMS Joomla extension (versions 1.0.0-4.1.3) is vulnerable to unauthenticated remote code execution, allowing attackers to assume complete control of web servers without credentials by…

Is there a public PoC exploit available for EUVD-2026-38108?

Yes, a public proof-of-concept exploit is available for EUVD-2026-38108. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate EUVD-2026-38108?

Within 24 hours: Inventory all Joomla installations and identify those running com_splms versions 1.0.0-4.1.3; isolate affected systems from internet-facing traffic or restrict access via firewall rules. Within 7 days: Implement compensating controls listed below, deploy Web Application Firewall rules to block malicious cookie patterns, and consider temporarily disabling the extension if business-critical functions permit. Within 30 days: Contact JoomShaper to request security timeline and patched release; evaluate replacement extensions or plan upgrade when fix is available; perform forensic audit of affected systems for exploitation evidence.

SP LMS EUVD-2026-38108

Q: What is the CVSS score of EUVD-2026-38108?

EUVD-2026-38108 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-48909 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-20 Joomla

GHSA-gf8c-xmwj-whrh

RCE Deserialization Sp Lms Extension For Joomla

9.5

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Cookie is parsed pre-auth over HTTP so AV:N/PR:N/UI:N; viable gadget chain is a real but low-effort barrier mapped to AC:L in 3.1, with full RCE giving C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 05:50 vuln.today

CVE Published

Jun 20, 2026 - 11:56 cve.org

CRITICAL 9.5

DescriptionCVE.org

SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation, enabling an unauthenticated remote attacker to execute arbitrary code on the server.

AnalysisAI

Unauthenticated remote code execution in JoomShaper's SP LMS (com_splms) Joomla extension versions 1.0.0 through 4.1.3 allows network attackers to run arbitrary code on the server by sending a crafted cookie that the component deserializes without validation. The flaw is a textbook PHP object injection (CWE-502) with a CVSS 4.0 base score of 9.5, but at time of analysis there is no public exploit identified and the issue is not on the CISA KEV list. Risk is elevated because the trigger is a cookie value parsed before any authentication check.

Technical ContextAI

The vulnerable component is SP LMS, a learning-management extension for the Joomla CMS published by JoomShaper (CPE cpe:2.3:a:joomshaper.net:sp_lms_extension_for_joomla). The root cause is CWE-502, Deserialization of Untrusted Data: the extension reads attacker-controlled cookie data and passes it to PHP's unserialize() (or a similar object-rebuilding routine) without integrity checks or an allow-list of classes. In a Joomla deployment the rebuilt object can chain into magic methods (__wakeup, __destruct, __toString) across loaded libraries, producing a POP-chain that yields arbitrary code execution under the web server account, which on most LAMP stacks is www-data or apache.

RemediationAI

Vendor-released patch: SP LMS 4.1.4 - upgrade com_splms to 4.1.4 or later via the Joomla extension manager as the primary fix, sourcing the package from https://www.joomshaper.com/ and cross-checking the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-48909 and https://vuldb.com/vuln/372540. Until the upgrade is applied, restrict reachability of the com_splms endpoints at the web server or WAF layer by blocking requests carrying the specific cookie name(s) the extension consumes, or by limiting access to authenticated sessions from known IPs; note that cookie stripping can break legitimate course state and that WAF rules on serialized PHP payloads (e.g. strings beginning with O: or a:) may produce false positives on other plugins. Disabling the com_splms component entirely is the highest-assurance interim control but takes the LMS offline for users.