CVE-2026-48908: JoomShaper SP Page Builder arbitrary file upload in Joomla

CVE-2026-48908 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-06-20

JoomShaper SP Page Builder, a popular tool for building websites on the Joomla platform, contains a critical security flaw that allows anyone on the internet to upload files to the server without logging in. An attacker can use this to upload malicious scripts and take full control of the website. This vulnerability has been reported as being actively exploited in the wild, posing an immediate risk to site operations and data security.

Technologies: JoomShaper SP Page Builder. Vendors: JoomShaper.

Quick answers

Is CVE-2026-48908 exploited in the wild?
Yes. CVE-2026-48908 is known to be exploited in the wild, first recorded on 7 July 2026. Treat it as urgent.
How severe is CVE-2026-48908?
Critical severity, with a CVSS score of 10, published 20 June 2026.
Which products and versions are affected?
JoomShaper SP Page Builder 1.0.0 through 6.6.1, 1.0.0-6.6.1.
Is there a fix for CVE-2026-48908?
A patch was published on 2026-06-30: Fix identified in version 6.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48908 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48908?
Check whether you run JoomShaper SP Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability (CWE-434) exists in the SP Page Builder extension for Joomla. The flaw allows unauthenticated remote attackers to bypass security checks and upload arbitrary files, including PHP scripts, to the web server. This is achieved via a network request to a vulnerable component, such as the 'uploadcustomicon' function. Successful exploitation leads to Remote Code Execution (RCE) with the privileges of the web server user. The vulnerability is reportedly being exploited in the wild as a zero-day. Users should update to version 6.6.2 or later to remediate the issue.

Affected products

  • JoomShaper SP Page Builder extension for Joomla 1.0.0 through 6.6.1

Timeline

  • 2026-06-20: disclosed: Initial disclosure by Joomla! Project
  • 2026-06-20: advisory: NVD published date
  • 2026-06-22: exploited: Reported as exploited in the wild (zero-day)
  • 2026-06-30: patched: Fix identified in version 6.6.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.