CVE-2026-48908: Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.12

Synopsis

An unauthenticated arbitrary file upload vulnerability in the SP Page Builder extension for Joomla (versions 1.0.0 through 6.6.1) allows any remote attacker to upload PHP files to the server without logging in. The flaw is reachable directly over the network and requires no prior access or user interaction. Successful exploitation gives the attacker full remote code execution on the hosting server. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Joomla instance via HTTP/HTTPS to exploit it.

• AuthenticationNot required

  No account or session token of any privilege level is needed; the file upload endpoint accepts requests from unauthenticated users.

• Victim interactionNot required

  The attacker triggers exploitation entirely server-side; no user action such as clicking a link or opening a file is involved.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or environmental prerequisites.

Blast Radius

• The attacker executes arbitrary PHP code under the web server process identity, giving them command execution on the underlying host.
• Confidential data stored by the Joomla application, including database credentials, session tokens, and user records, is readable by the attacker.
• The attacker can write, modify, or delete files accessible to the web server process, including application code, configuration files, and uploaded media.
• The compromise extends beyond the container boundary: CVSS v4.0 tokens indicate high impact on subsequent systems (SC:H/SI:H/SA:H), meaning lateral movement or disruption of downstream infrastructure is achievable from the initial foothold.