CVE-2026-81565
Received Received - Intake

Path Traversal in SP Page Builder Joomla Extension

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Joomla! Project

Description
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create() and File::upload() without either of the directory boundary checks applied elsewhere in the same file. Files could be written into any directory beneath the web root, including administrator/, templates/, cli/ and the site root. Joomla's PATH input filter prevented traversal above the web root, and existing files were not overwritten.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-81565
EUVD
EUVD-2026-77383

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joomshaper sp_page_builder From 4.0.0 (inc) to 6.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SP Page Builder for Joomla allows attackers to bypass directory restrictions during file uploads. The flaw occurs because the folder parameter completely replaces the default date-based destination folder without proper validation. This lets files be written to any directory under the web root, including sensitive areas like administrator/, templates/, cli/, or the site root.

Detection Guidance

This vulnerability allows arbitrary file uploads to sensitive directories. Check for unexpected files in directories like administrator/, templates/, cli/, or site root. Review Joomla logs for unusual media uploads or file creation events. Use commands like 'find /var/www/html -type f -mtime -7' to check for recently modified files in web directories.

Impact Analysis

An attacker could upload malicious files to critical directories, potentially gaining unauthorized access to the system. They might execute arbitrary code, deface the website, or steal sensitive data. Even though existing files aren't overwritten, the ability to write files anywhere under the web root poses significant security risks.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized access to personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately update SP Page Builder to version 6.9.1 or later. If updating is not possible, disable file uploads in SP Page Builder or restrict write permissions to web directories. Monitor for unauthorized file creation and review Joomla's PATH input filter configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81565. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart