CVE-2026-48908

Analyzed Analyzed - Analysis Complete

Arbitrary File Upload in SP Page Builder for Joomla

Publication date: 2026-06-20

Last updated on: 2026-07-08

Assigner: Joomla! Project

Description

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-20

Last Modified

2026-07-08

Generated

2026-07-10

AI Q&A

2026-06-20

EPSS Evaluated

2026-07-09

NVD

CVE-2026-48908

EUVD

EUVD-2026-38110

Affected Vendors & Products

Vendor	Product	Version / Range
ollyo	sp_page_builder	to 6.6.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Compliance Impact

The vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution. This security flaw can compromise the confidentiality, integrity, and availability of data hosted on affected websites.

Such a compromise could lead to unauthorized access to personal or sensitive data, potentially violating compliance requirements under regulations like GDPR and HIPAA, which mandate strict controls over data protection and breach prevention.

Therefore, organizations using the vulnerable SP Page Builder may face increased risk of non-compliance with these standards if the vulnerability is exploited, as it undermines the security measures required to protect regulated data.

Executive Summary

This vulnerability exists in the SP Page Builder for Joomla, which allows unauthenticated users to upload arbitrary files.

Because of this flaw, attackers can upload and execute PHP code on the affected system.

Impact Analysis

The vulnerability can have severe impacts as it allows attackers to execute arbitrary PHP code on your server.

This can lead to full system compromise, unauthorized access, data theft, defacement of websites, or use of the server for malicious activities.

Hi! I’m here to help you understand CVE-2026-48908. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70