EUVD-2026-38110
GHSA-8fwr-8fxr-8v2p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconScan for Joomla sites with SP Page Builder
-
DeliveryPOST PHP webshell to unauthenticated upload endpoint
-
ExploitExtension writes file to web-served path
-
InstallRequest shell URL to execute PHP
-
C2Read configuration.php and DB credentials
-
ExecuteInstall persistent backdoor
-
ImpactFull site and database compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The SP Page Builder extension (versions 1.0.0-6.6.1) must be installed and enabled on a network-reachable Joomla site, and the component's file-upload endpoint must be accessible over HTTP/HTTPS - the default configuration of the extension. The PHP handler must be active for the directory where uploads are written (the Joomla default), and the web-server user must have write permission to that directory (also default). No Joomla or SP Page Builder account, no admin session, and no user interaction are required (CVSS PR:N, UI:N, AT:N). Limiting factors are narrow: sites that have removed the extension, blocked its upload endpoints at a WAF, or disabled PHP execution in upload directories are not exploitable through this vector. |
| Impact | All available signals converge on a critical, real-world risk. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N yields a 10.0 with full vulnerable-system and subsequent-system impact (VC/VI/VA/SC/SI/SA all H), the Exploit Maturity metric is set to Active (E:A) by the reporter, and the SSVC-relevant attributes - network-reachable, no authentication, no user interaction, automatable - make this an attractive target for opportunistic mass scanning. The CWE-284 access-control failure combined with PHP upload to a web-served path is a well-understood, easy-to-weaponize pattern in Joomla extensions. There is no CISA KEV listing, EPSS score, or public PoC referenced in the provided data, so 'Active' status is vendor-asserted rather than CISA-confirmed; defenders should treat this as imminent rather than already widespread until corroborating telemetry appears. No CVSS 3.1 vector was supplied, so the 10.0 figure is from CVSS 4.0 only. |
| Exploit ScenarioDerived | An opportunistic attacker scanning the internet for Joomla sites running SP Page Builder sends an unauthenticated HTTP POST to the vulnerable upload endpoint carrying a small PHP webshell. The server writes the file to a web-served directory, and the attacker immediately requests its URL to execute commands as the web-server user, then pivots to read configuration.php for database credentials and drop a persistent backdoor. No public PoC is referenced in the provided data, but the bug class is trivially weaponized. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 22, 2026
Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through 6.6.1) allows attackers to upload PHP files that execute on the server, leading to full site compromise. CVSS 4.0 base score is 10.0 with the vendor flagging exploitation as Active (E:A), and no public exploit identified at time of analysis. Given the unauthenticated network vector and direct RCE outcome, this is a critical-priority issue for any Joomla site running the extension.
RemediationAI
No vendor-released patched version is identified in the provided data, so administrators should upgrade SP Page Builder to the latest release published by JoomShaper as soon as it is available - monitor https://www.joomshaper.com/page-builder and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-48908 for the fixed version number. Until a patched build is installed, disable or uninstall the SP Page Builder component from the Joomla Extension Manager (this will break any front-end pages built with it, so plan a static export or temporary theme fallback), or, if the extension must remain enabled, restrict access to the SP Page Builder upload endpoints at the web server / WAF layer (block POST requests to the component's ajax/upload routes from untrusted source IPs) and ensure the Joomla 'images' / component upload directories have PHP execution disabled via .htaccess 'php_flag engine off' or an equivalent nginx location block - note this may break legitimate dynamic image handlers that rely on PHP in those paths. Audit the site filesystem and webroot for unexpected .php, .phtml, .phar, or double-extension files created since the extension was installed, and rotate Joomla admin credentials and database passwords if any are found.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SP Page Builder is a widely deployed drag-and-drop page builder extension for the Joomla CMS, developed by JoomShaper (CPE cpe:2.3:a:joomshaper.net:sp_page_builder_extension_for_joomla). The flaw is classified under CWE-284 (Improper Access Control): an upload endpoint exposed by the extension does not enforce authentication or restrict uploaded file types/extensions, so an attacker can place a PHP file inside a web-served directory. Because Joomla serves PHP files through the standard mod_php / php-fpm handler, the uploaded file is executed in the Joomla site's PHP context on request, granting code execution with the privileges of the web server user and access to Joomla configuration and database credentials.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red
Unauthenticated remote PHP upload over HTTP yields AV:N/AC:L/PR:N/UI:N; arbitrary code execution as the web user gives full C/I/A impact within the Joomla site's security scope.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the SP Page Builder for Joomla allows the upload of arbitrary files for unauthenticated users, ultimately resulting in PHP code upload and execution.
Articles & Coverage 1
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB