CVE-2026-48908

Description

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Scoring

• CVSS: 9.8 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-07-07
• Remediation due date: 2026-07-10
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-434
• CWE-434

References

• https://www.joomshaper.com/page-builder
• https://extensions.joomla.org/extension/sp-page-builder/
• https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908
• https://www.joomshaper.com/forum/question/45152

More from JoomShaper

• No other tracked CVEs for this vendor yet.