CVE-2026-48909: Joomla Extension - joomshaper.com - PHP Object injection in SP LMS extension for Joomla < 4.1.4

Synopsis

PHP object injection (unsafe deserialization) in the SP LMS extension (com_splms) for Joomla allows an unauthenticated remote attacker to execute arbitrary code on the server. The extension deserializes user-controlled cookie data without any validation, reachable over the network with no credentials required. Successful exploitation gives the attacker full remote code execution, reading, modification, and disruption of the host and any downstream systems. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the Joomla host.

• AuthenticationNot required

  No account or session credential is needed; the malicious payload is delivered in an unauthenticated cookie.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering step is involved.

• Attack complexityDetail

  Base exploit complexity is low and condition-free, though the CVSS AT:P token notes that a specific deployment condition (such as a gadget chain present in the PHP environment) must be met for the payload to execute.

Blast Radius

• Attacker executes arbitrary OS commands on the web server, with the privileges of the PHP process.
• Attacker reads all data accessible to that process, including database credentials, session tokens, and stored customer records.
• Attacker modifies or deletes persisted database rows, application files, or configuration, affecting the integrity of the Joomla site and any connected systems.
• Attacker crashes or degrades the affected service and any downstream systems that share the same host or trust boundary, as reflected in the CVSS v4.0 subsequent-system impact scores.