CVE-2026-48908
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
Description
CVE-2026-48908 is a critical unrestricted file upload vulnerability in JoomShaper's SP Page Builder extension for Joomla that lets unauthenticated attackers upload and execute arbitrary PHP code. Because the extension does not properly validate uploaded file types, an attacker can plant a web shell and achieve remote code execution on the underlying server without any credentials. The flaw carries a CVSS score of 9.8 (Critical) and affects SP Page Builder versions before 6.6.2. CISA has added CVE-2026-48908 to its Known Exploited Vulnerabilities (KEV) catalog, confirming it is being exploited in the wild, which makes prompt remediation essential for any site running the affected SP Page Builder versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ollyo | sp page builder | < 6.6.2 |
References
- https://www.joomshaper.com/page-builder(Product)
- https://extensions.joomla.org/extension/sp-page-builder/(Product)
- https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908(US Government Resource)
- https://www.joomshaper.com/forum/question/45152(Issue Tracking)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
This vulnerability occurs because SP Page Builder allows files to be uploaded without properly validating, restricting, or handling their type, so an attacker can upload dangerous content such as a PHP web shell. In SP Page Builder the weakness manifests through a file upload path that accepts executable PHP files, which the web server then runs, giving the attacker code execution.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2026-48908 earns a Critical CVSS 3.1 score of 9.8 because every barrier to exploitation is absent. The vulnerability is remotely exploitable over the network without physical access, it is easy to exploit with no special conditions needed (Attack Complexity Low), it requires no authentication (Privileges Required None), and it needs no user action (User Interaction None). A successful upload of PHP code results in full remote code execution: the High confidentiality, integrity, and availability impacts mean an attacker can read sensitive data, tamper with site content and databases, and disrupt or take down the affected Joomla site entirely. Because CISA lists this vulnerability in its KEV catalog, exploitation is confirmed in the wild and the risk is immediate rather than theoretical.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-48908 in the wild by adding it to the Known Exploited Vulnerabilities catalog, so this is not a theoretical risk. A third-party advisory documenting the "uploadCustomIcon" RCE zero-day is publicly available via mysites.guru, providing detailed technical background on the flaw. The EPSS score of roughly 1.6% (72nd percentile) understates the real-world urgency given the confirmed KEV listing; ransomware use is currently listed as Unknown. Organizations running SP Page Builder should treat this as an act-now vulnerability and patch immediately.
Remediation
- Follow CISA's KEV required action: apply mitigations in accordance with vendor instructions, ensure compliance with CISA's BOD 26-04 patching guidance, and discontinue use of the product if mitigations are unavailable. The remediation due date was 2026-07-10.
- Upgrade SP Page Builder to version 6.6.2 or later, as all versions before 6.6.2 are affected.
- As an interim mitigation, restrict access to the upload functionality and the Joomla administrator paths, and deploy WAF rules to block uploads of PHP and other executable file types to the affected endpoint.
- Review web server and upload directory logs for unexpected files (especially .php files in upload locations) and for suspicious requests to the SP Page Builder upload handler, and check for any web shells that may already have been planted.
- As long-term hardening, enforce a whitelist of allowed file extensions, validate file content by magic bytes rather than extension alone, rename uploaded files to strip executable extensions, and store uploads outside the web root or in a location that cannot execute scripts.
Technical Details
The root cause of CVE-2026-48908 is CWE-434, an unrestricted upload of a file with a dangerous type: SP Page Builder accepts uploaded files without adequately validating or restricting their type, allowing a PHP file to be written into a web-accessible directory and executed by the server. The attack is delivered over the network (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), which is why the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields the maximal 9.8 score for an unchanged scope. Once the malicious PHP file is uploaded and requested, the attacker gains code execution in the context of the web application, explaining the High confidentiality, integrity, and availability impact.
Frequently Asked Questions
Is CVE-2026-48908 being actively exploited?
Yes. CISA has added CVE-2026-48908 to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. A public third-party advisory documenting the upload-based remote code execution also exists, and ransomware association is currently listed as Unknown.
What products are affected by CVE-2026-48908?
The vulnerability affects JoomShaper's SP Page Builder extension for Joomla in all versions before 6.6.2. Sites running SP Page Builder should verify their version and upgrade to 6.6.2 or later.
How do I fix CVE-2026-48908?
Upgrade SP Page Builder to version 6.6.2 or later and apply mitigations per the vendor's instructions in line with CISA's KEV guidance. As interim measures, restrict access to the upload functionality, block executable file uploads with WAF rules, and review logs and upload directories for any web shells already planted.
How severe is CVE-2026-48908?
It is Critical, carrying the maximum-tier CVSS 3.1 score of 9.8. Because it allows unauthenticated remote code execution with no user interaction and is confirmed as actively exploited in CISA's KEV catalog, it represents one of the most serious vulnerability classes for a web application.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.