CVE catalog

CVE-2026-48908

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

[CVE catalog]

Severity
Critical · CVSS 10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red
Published
Source
[NVD] · [CVE record]
Exploitation
CISA Known Exploited Vulnerabilities
EPSS
88.51% · Oct 25, 2026

JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpesp_page_builderNot reported6.6.2fixed
Cpesp_page_builderNot reported6.6.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpesp_page_buildercpeNot reported6.6.2Not reportedNot reportedNot reported
Cpesp_page_buildercpeNot reported6.6.2Not reportedNVD-CVE-2026-48908Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CISA Known Exploited Vulnerabilities (OSINT)] · [FIRST EPSS] · [National Vulnerability Database (NVD)]