Executive brief
SP Page Builder is a popular drag-and-drop design tool for Joomla websites. A security flaw in its media management component allows users with low-level permissions (such as authors) to delete critical system files. This could lead to a complete website outage or the removal of security configuration files, potentially exposing the site to further attacks.
Technical details
An authenticated arbitrary file deletion vulnerability exists in the media manager component of SP Page Builder. The root cause is a lack of path traversal guards and improper input validation in the media delete action (specifically within media.php). While other deletion paths in the extension utilized traversal protections, this specific vector allowed a request-supplied path to be processed without sufficient filtering. An attacker with low-privilege 'author' permissions can exploit this to delete sensitive files in the web root, such as configuration.php or .htaccess. This vulnerability was addressed in version 6.7.1 by implementing proper path validation and ACL checks.
Affected products
- JoomShaper (joomshaper.com) SP Page Builder extension for Joomla 1.0.0 through 6.7.0
Timeline
- 2026-07-27: patched: Fixed in version 6.7.1
- 2026-07-27: disclosed: Public disclosure by mySites.guru and Joomla Project
- 2026-07-27: advisory