CVE-2026-48908 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-20

Added to CISA KEV: 2026-07-07 17 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review web server logs for POST requests to the com_sppagebuilder component and asset.uploadCustomIcon endpoint, hunt for unexpected PHP files in upload/media directories, and verify site integrity for web shells.
IMMEDIATELY update SP Page Builder to version 6.6.2 or later per the vendor advisory (joomshaper.com); this is the highest priority given active exploitation.
Restrict access to the Joomla administrative interface, deploy a WAF with rules to block malicious file uploads, and monitor for anomalous traffic targeting the vulnerable endpoint until patched.
PATCH PRIORITY: EMERGENCY — patch within 24-48 hours (CISA KEV binding operational directive timelines apply to federal agencies; treat as emergency for all organizations). Assume compromise and perform IR/forensic review if patching was delayed.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-48908 is a critical-severity, unauthenticated remote code execution (RCE) vulnerability affecting the SP Page Builder extension for Joomla ^[1]. The flaw stems from a complete lack of authentication and file-type validation within the component's icon-upload controller, which allows remote attackers to upload and execute arbitrary PHP files on the underlying web server ^[1]^[3]. This is a significant security risk because it permits full system compromise without requiring any user credentials or interaction ^[1].

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog ^[2]^[4].
PoC Availability: Multiple proof-of-concept (PoC) exploit scripts are publicly available on platforms such as GitHub, demonstrating how to achieve RCE via the `asset.uploadCustomIcon` function ^[5]^[6].
Attack Prerequisites:

- Network Access: Remote (internet-facing). - Authentication: None required (unauthenticated). - User Interaction: None required.

Affected Products & Patches

Affected Versions: All versions of the SP Page Builder extension for Joomla up to and including 6.6.1 ^[1].
Patch/Hotfix: Users should update the SP Page Builder extension to the latest available version provided by the vendor to remediate the vulnerability.
Mitigations: If patching is not immediately possible, organizations should restrict access to the Joomla administrative interface and monitor web logs for suspicious file upload activity or anomalous traffic targeting the `com_sppagebuilder` component.

Impact

Access/Capability: Successful exploitation grants the attacker the ability to execute arbitrary PHP code on the server, typically leading to full web shell control, data theft, and potential lateral movement within the network ^[1]^[3].
Business Risk: Internet-facing deployments face a critical risk of total site takeover, which can result in long-term service disruption, data breaches, and the deployment of ransomware or other malicious payloads that can damage the organization's reputation and operational integrity ^[2].

Sources

CVE-2026-48908 – Unauthenticated File Upload Leading ...
CVE-2026-48908 is a maximum-severity unauthenticated remote code execution (RCE) vulnerability in the SP Page Builder extension for Joomla, ... CVE-2026-48908 is a maximum-severity unauthenticated remote code execution (RCE) vulnerability in the SP Page Builder extension for Joomla, affecting all ve…
CISA Adds Three Known Exploited Vulnerabilities to Catalog
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize ...
CVE-2026-48908 - Vulnerability Details - OpenCVE
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
Joomla SP Page Builder RCE - FortiGuard Labs - Fortinet
What is the Vulnerability?FortiGuard telemetry shows continued exploitation attempts targeting vulnerable Joomla SP Page Builder ...
GitHub - papageo75/CVE-2026-48908-PoC: Unauthenticated RCE PoC for CVE ...
Keywords Joomla SP Page Builder exploit · com_sppagebuilder unauthenticated RCE · CVE-2026-48908 PoC · asset.uploadCustomIcon arbitrary file upload · Joomla remote code execution · pentest exploit script.

🔴 CVE-2026-48908