CVE-2026-48908

CriticalPublished

Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2

Published: Jun 20, 2026
Updated: Oct 8, 2026
Assigning CNA: Joomla
Evidence observed: Jul 7, 2026

Primary CVSS

10.0/ 10Critical

nvd · CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

EPSS probability estimate

88.5%

High · next 30 days

Percentile: 99.8%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Template

Joomla SP Page Builder <= 6.6.1 - Unauthenticated Arbitrary File Upload RCETemplate
javascript/cves/2026/CVE-2026-48908.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)

CVE-2026-48908Exploit
Unauthenticated RCE PoC for CVE-2026-48908 SP Page Builder (Joomla) arbitrary file upload and remote code execution exploit with mass scaning support.
CVE-2026-48908Exploit

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.