erroneo.us
Search all guides⌘K

Security Digest · Jun 15, 2026 · Vulnerability · Web framework

SP Page Builder CVE-2026-48908: Exploited Joomla RCE

Unauthenticated file upload in JoomShaper's SP Page Builder for Joomla gives attackers PHP execution; mass-exploited, in KEV. Fixed in 6.6.2. Update and hunt.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Act now

Any Joomla site still on SP Page Builder 6.6.1 or older should be updated today and treated as compromised, because automated attacks have been planting web shells and admin accounts since June.

Who must act: Owners, agencies and hosts of Joomla sites that run JoomShaper's SP Page Builder below 6.6.2, and anyone who updated late and never checked for web shells or rogue Super Users.

Who can relax: Joomla sites without SP Page Builder, and sites that moved to 6.6.2 or later before exploitation began and have since confirmed no unknown admins or PHP files.

Affected
SP Page Builder for Joomla 1.0.0 through 6.6.1 (CVE record; mySites.guru places the vulnerable endpoint in 4.0.0 and later)
Fixed in
SP Page Builder 6.6.2 (June 15, 2026)
SP Page Builder 6.10.0 (Oct 7, 2026), the current release, which also includes later security fixes
CVSS
10.0 (v4.0, CNA)
EPSS
88.5% (percentile 99.8)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Check the SP Page Builder version on every Joomla site in the administrator's Extensions: Manage screen.
  2. Update to the current SP Page Builder (6.10.0 as of Oct 21, 2026), at minimum 6.6.2; unpublishing the component does not close the hole.
  3. Audit the Super Users group and delete administrator accounts your team did not create.
  4. Search web roots, /images/ and /media/ for unexpected PHP files and remove web shells, or restore from a known-clean backup.
  5. Rotate the database password in configuration.php and any other secrets the site stores.
  6. If you cannot update immediately, disable the extension or block public requests to index.php?option=com_sppagebuilder at the web server or WAF.

How to check if you are affected or compromised

  • Search access logs for requests containing option=com_sppagebuilder and task=asset.uploadCustomIcon, especially POSTs from clients that never logged in.
  • List Super User accounts and look for ones you did not create; ChronoEngine reports fake addresses ending in @secure.local.
  • Find recently added or modified .php files under /media/com_sppagebuilder/, /images/ and other media or temp folders.
  • On sites that updated to 6.6.2, confirm the update replaced administrator/components/com_sppagebuilder/editor/traits/IconsTrait.php, since one site owner reported uploads still succeeding.

What happened#

SP Page Builder, JoomShaper's drag-and-drop page builder for Joomla, shipped a custom-icon upload feature that anyone could call. The asset.uploadCustomIcon task in com_sppagebuilder accepted a file "with no login and no file-type check," according to mySites.guru. Phil Taylor of mySites.guru is one of two finders credited in the CVE record. An attacker uploads a PHP file disguised as an icon, requests it, and runs code as the web server. mySites.guru calls it a zero-day "being actively exploited in the wild."

JoomShaper released 6.6.2 on June 15, 2026, per its release notes, which list only "1 fixed" for that version. Joomla's CNA published the CVE record on June 20 with a CVSS 4.0 score of 10.0 and an exploit maturity of "attacked." NVD rates it 9.8 on CVSS 3.1. CISA added it to the KEV catalog on July 7, the same day as a similar upload bug in Joomlack's Page Builder CK (CVE-2026-56290). The summer's Joomla extension wave also put JCE and Balbooa Forms in KEV.

Who is affected#

The CVE record lists SP Page Builder 1.0.0 through 6.6.1. mySites.guru narrows the vulnerable code to 4.0.0 and later and says the Joomla 3-era 3.x line lacks the affected controller. Joomla core is not the problem: a fully patched Joomla 5 or 6 site is exposed if this extension is installed and old. CSA Singapore warned on July 10 that both page builder bugs were under active exploitation and told admins to look for "unauthorised account creation."

Two caveats on the fix. A site owner reported on JoomShaper's forum that after updating to 6.6.2, a bot still got HTTP 200 responses from the upload endpoint and IconsTrait.php lacked the new check. Staff replied that the editor controller already enforces authentication and later said the issue was fixed in the changelog. Separately, later releases fixed other serious bugs, including an unauthenticated SQL injection patched in 6.8.0. Running the current release avoids both questions.

Do you really need to act?#

Yes, if any site you own or host still runs 6.6.1 or older. This is one unauthenticated request to code execution, and it is being sprayed by automated scripts, not used in targeted attacks. Beazley Security reports attackers writing PHP file-manager backdoors into the web root and creating hidden administrator accounts. mySites.guru saw droppers read configuration.php for database credentials. ChronoEngine describes rogue Super Users with fake @secure.local addresses.

Updating closes the door but does not evict anyone. JoomShaper staff say on the forum that updating alone "does not remove malicious files or backdoors" uploaded earlier. If a site sat on a vulnerable version after mid-June, assume it was hit until you have checked.

What to do now#

  1. Check the installed version in the Joomla administrator's Extensions: Manage screen on every site, including staging copies and client sites you host.
  2. Update to the current release (6.10.0 as of October 21, 2026), at minimum 6.6.2. Unpublishing the component is not enough.
  3. Open Users and filter by the Super Users group. Delete accounts nobody on your team created, then reset the remaining admin passwords and enable MFA.
  4. Find and remove web shells: find . -name '*.php' -newermt 2026-06-01 \( -path './images/*' -o -path './media/*' -o -path './tmp/*' \). If in doubt, restore from a backup taken before June.
  5. Change the database password in configuration.php and rotate any API keys or SMTP credentials the site stores.
  6. If an update has to wait, disable the extension or block option=com_sppagebuilder requests from the public at the web server or WAF.

How to tell if you were hit#

Search access logs for option=com_sppagebuilder together with task=asset.uploadCustomIcon, especially POSTs from addresses that never logged in, followed by requests for new .php files. ChronoEngine names /media/com_sppagebuilder/assets/iconfont/ as an upload location, and /media/com_admin/ and /images/ as backdoor locations. Unknown Super Users, unfamiliar PHP files in media folders, or unexpected outbound connections from the web server mean the site is compromised. Rebuild from a clean backup, re-apply the update and rotate every credential the site could read.

Timeline#

  • — JoomShaper releases SP Page Builder 6.6.2. mySites.guru publishes its disclosure.
  • — Joomla's CNA publishes CVE-2026-48908 (CVSS 4.0 10.0, exploitation "attacked").
  • — CISA adds the CVE to KEV with a July 10 federal deadline.
  • — CSA Singapore warns of active exploitation of Joomla page builder extensions.
  • — SP Page Builder 6.8.0 fixes a separate unauthenticated SQL injection.
  • — SP Page Builder 6.10.0, the current release, ships.

Vulnerability records

  • CVE-2026-48908 · KEV 2026-07-07 · A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. JoomShaper — Release notes (SP Page Builder 6.6.2 through 6.10.0) joomshaper.com
  2. JoomShaper forum — Security Updates (staff: fixed in SP Page Builder v6.6.2) joomshaper.com
  3. CVE record — CVE-2026-48908 cve.org
  4. NVD — CVE-2026-48908 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2026-48908 cisa.gov
  6. mySites.guru — CVE-2026-48908: SP Page Builder unauthenticated file upload mysites.guru
  7. JoomShaper forum — Security issue still present in SP Page Builder 6.6.2 joomshaper.com
  8. JoomShaper — SP Page Builder v6.8.0 release joomshaper.com
  9. CSA Singapore — Active exploitation of critical vulnerabilities in Joomla extensions (AL-2026-085) csa.gov.sg
  10. Beazley Security Labs — BSL-A1187: Joomla page builder extensions exploited labs.beazley.security
  11. ChronoEngine — Critical zero-day RCE exploit actively targeting SP Page Builder chronoengine.com