CVE-2026-81565
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create() and File::upload() without either of the directory boundary checks applied elsewhere in the same file. Files could be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.
| CWE | CWE-22 |
| Vendor | joomshaper.com |
| Product | sp page builder (free and pro) extension for joomla |
| Published | Sep 14, 2026 |
| Last Updated | Sep 15, 2026 |
Get instant alerts for joomshaper.com sp page builder (free and pro) extension for joomla
Be the first to know when new unknown vulnerabilities affecting joomshaper.com sp page builder (free and pro) extension for joomla are published — delivered to Slack, Telegram or Discord.