Is CVE-2026-65878 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65878 being exploited in the wild.

How severe is CVE-2026-65878?

Informational severity, with a CVSS score of 7.2, published 27 July 2026.

Which products and versions are affected?

JoomShaper SP Page Builder 1.0.0 through 6.7.0.

Is there a fix for CVE-2026-65878?

A patch was published on 2026-07-27: Fixed in version 6.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65878 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-65878?

Check whether you run JoomShaper SP Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65878: JoomShaper SP Page Builder Arbitrary File Deletion in Media Manager

CVE-2026-65878 · Severity: info · CVSS 7.2 · Published 2026-07-27

SP Page Builder is a popular drag-and-drop design tool for Joomla websites. A security flaw in its media management component allows users with low-level permissions (such as authors) to delete critical system files. This could lead to a complete website outage or the removal of security configuration files, potentially exposing the site to further attacks.

Technologies: JoomShaper SP Page Builder. Vendors: JoomShaper.

Quick answers

Is CVE-2026-65878 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65878 being exploited in the wild.
How severe is CVE-2026-65878?: Informational severity, with a CVSS score of 7.2, published 27 July 2026.
Which products and versions are affected?: JoomShaper SP Page Builder 1.0.0 through 6.7.0.
Is there a fix for CVE-2026-65878?: A patch was published on 2026-07-27: Fixed in version 6.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65878 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-65878?: Check whether you run JoomShaper SP Page Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated arbitrary file deletion vulnerability exists in the media manager component of SP Page Builder. The root cause is a lack of path traversal guards and improper input validation in the media delete action (specifically within media.php). While other deletion paths in the extension utilized traversal protections, this specific vector allowed a request-supplied path to be processed without sufficient filtering. An attacker with low-privilege 'author' permissions can exploit this to delete sensitive files in the web root, such as configuration.php or .htaccess. This vulnerability was addressed in version 6.7.1 by implementing proper path validation and ACL checks.

Affected products

JoomShaper (joomshaper.com) SP Page Builder extension for Joomla 1.0.0 through 6.7.0

Timeline

2026-07-27: patched: Fixed in version 6.7.1
2026-07-27: disclosed: Public disclosure by mySites.guru and Joomla Project
2026-07-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.