CVE-2026-48908
Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
CVSS Score
0.0
EPSS Score
1.6%
EPSS Percentile
72th
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
| CWE | CWE-434 |
| Vendor | joomshaper.net |
| Product | sp page builder extension for joomla |
| Published | Jun 20, 2026 |
| Last Updated | Jul 15, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for joomshaper.net sp page builder extension for joomla
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-48908.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
joomshaper.net / SP Page Builder extension for Joomla
1.0.0-6.6.1
References
joomshaper.com: https://www.joomshaper.com/page-builder mysites.guru: https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/ joomshaper.com: https://www.joomshaper.com/forum/question/45152 extensions.joomla.org: https://extensions.joomla.org/extension/sp-page-builder/ cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908
Credits
Phil Taylor [email protected] / @mrzblackhat