---
title: "SP Page Builder CVE-2026-48908: Exploited Joomla RCE"
url: https://erroneo.us/security/briefs/sp-page-builder-cve-2026-48908-unauthenticated-upload-rce/
description: "Unauthenticated file upload in JoomShaper's SP Page Builder for Joomla gives attackers PHP execution; mass-exploited, in KEV. Fixed in 6.6.2. Update and hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-06-15
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-48908"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SP Page Builder CVE-2026-48908: Exploited Joomla RCE

**Verdict: Act now.** Any Joomla site still on SP Page Builder 6.6.1 or older should be updated today and treated as compromised, because automated attacks have been planting web shells and admin accounts since June.

- **Who must act:** Owners, agencies and hosts of Joomla sites that run JoomShaper's SP Page Builder below 6.6.2, and anyone who updated late and never checked for web shells or rogue Super Users.
- **Who can relax:** Joomla sites without SP Page Builder, and sites that moved to 6.6.2 or later before exploitation began and have since confirmed no unknown admins or PHP files.
- **Affected:** SP Page Builder for Joomla 1.0.0 through 6.6.1 (CVE record; mySites.guru places the vulnerable endpoint in 4.0.0 and later)
- **Fixed:** SP Page Builder 6.6.2 (June 15, 2026); SP Page Builder 6.10.0 (Oct 7, 2026), the current release, which also includes later security fixes
- **CVEs:** CVE-2026-48908
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the SP Page Builder version on every Joomla site in the administrator's Extensions: Manage screen.
2. Update to the current SP Page Builder (6.10.0 as of Oct 21, 2026), at minimum 6.6.2; unpublishing the component does not close the hole.
3. Audit the Super Users group and delete administrator accounts your team did not create.
4. Search web roots, /images/ and /media/ for unexpected PHP files and remove web shells, or restore from a known-clean backup.
5. Rotate the database password in configuration.php and any other secrets the site stores.
6. If you cannot update immediately, disable the extension or block public requests to index.php?option=com_sppagebuilder at the web server or WAF.

### How to check if you are affected

- Search access logs for requests containing option=com_sppagebuilder and task=asset.uploadCustomIcon, especially POSTs from clients that never logged in.
- List Super User accounts and look for ones you did not create; ChronoEngine reports fake addresses ending in @secure.local.
- Find recently added or modified .php files under /media/com_sppagebuilder/, /images/ and other media or temp folders.
- On sites that updated to 6.6.2, confirm the update replaced administrator/components/com_sppagebuilder/editor/traits/IconsTrait.php, since one site owner reported uploads still succeeding.

## What happened

SP Page Builder, JoomShaper's drag-and-drop page builder for Joomla, shipped a custom-icon upload feature that anyone could call. The `asset.uploadCustomIcon` task in `com_sppagebuilder` accepted a file "with no login and no file-type check," according to [mySites.guru](https://mysites.guru/vulnerabilities/CVE-2026-48908/). Phil Taylor of mySites.guru is one of two finders credited in the CVE record. An attacker uploads a PHP file disguised as an icon, requests it, and runs code as the web server. mySites.guru calls it a zero-day "being actively exploited in the wild."

JoomShaper released 6.6.2 on June 15, 2026, per its [release notes](https://www.joomshaper.com/release), which list only "1 fixed" for that version. Joomla's CNA published the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-48908) on June 20 with a CVSS 4.0 score of 10.0 and an exploit maturity of "attacked." [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-48908) rates it 9.8 on CVSS 3.1. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908) on July 7, the same day as a similar upload bug in Joomlack's Page Builder CK (CVE-2026-56290). The summer's Joomla extension wave also put JCE and Balbooa Forms in KEV.

## Who is affected

The CVE record lists SP Page Builder 1.0.0 through 6.6.1. mySites.guru narrows the vulnerable code to 4.0.0 and later and says the Joomla 3-era 3.x line lacks the affected controller. Joomla core is not the problem: a fully patched Joomla 5 or 6 site is exposed if this extension is installed and old. [CSA Singapore](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-085/) warned on July 10 that both page builder bugs were under active exploitation and told admins to look for "unauthorised account creation."

Two caveats on the fix. A site owner reported on [JoomShaper's forum](https://www.joomshaper.com/forum/question/45358) that after updating to 6.6.2, a bot still got HTTP 200 responses from the upload endpoint and `IconsTrait.php` lacked the new check. Staff replied that the editor controller already enforces authentication and later said the issue was fixed in the changelog. Separately, later releases fixed other serious bugs, including an unauthenticated SQL injection patched in [6.8.0](https://www.joomshaper.com/blog/sp-page-builder-v6-8-0). Running the current release avoids both questions.

## Do you really need to act?

Yes, if any site you own or host still runs 6.6.1 or older. This is one unauthenticated request to code execution, and it is being sprayed by automated scripts, not used in targeted attacks. [Beazley Security](https://labs.beazley.security/advisories/BSL-A1187) reports attackers writing PHP file-manager backdoors into the web root and creating hidden administrator accounts. mySites.guru saw droppers read `configuration.php` for database credentials. [ChronoEngine](https://www.chronoengine.com/blog/critical-zero-day-rce-exploit-actively-targeting-sp-page-builder-cve-2026-48908) describes rogue Super Users with fake `@secure.local` addresses.

Updating closes the door but does not evict anyone. JoomShaper staff say on the [forum](https://www.joomshaper.com/forum/question/45474) that updating alone "does not remove malicious files or backdoors" uploaded earlier. If a site sat on a vulnerable version after mid-June, assume it was hit until you have checked.

## What to do now

1. Check the installed version in the Joomla administrator's Extensions: Manage screen on every site, including staging copies and client sites you host.
2. Update to the current release (6.10.0 as of October 21, 2026), at minimum 6.6.2. Unpublishing the component is not enough.
3. Open Users and filter by the Super Users group. Delete accounts nobody on your team created, then reset the remaining admin passwords and enable MFA.
4. Find and remove web shells: `find . -name '*.php' -newermt 2026-06-01 \( -path './images/*' -o -path './media/*' -o -path './tmp/*' \)`. If in doubt, restore from a backup taken before June.
5. Change the database password in `configuration.php` and rotate any API keys or SMTP credentials the site stores.
6. If an update has to wait, disable the extension or block `option=com_sppagebuilder` requests from the public at the web server or WAF.

## How to tell if you were hit

Search access logs for `option=com_sppagebuilder` together with `task=asset.uploadCustomIcon`, especially POSTs from addresses that never logged in, followed by requests for new `.php` files. ChronoEngine names `/media/com_sppagebuilder/assets/iconfont/` as an upload location, and `/media/com_admin/` and `/images/` as backdoor locations. Unknown Super Users, unfamiliar PHP files in media folders, or unexpected outbound connections from the web server mean the site is compromised. Rebuild from a clean backup, re-apply the update and rotate every credential the site could read.

## Timeline

- Jun 15, 2026 — JoomShaper releases SP Page Builder 6.6.2. mySites.guru publishes its disclosure.
- Jun 20, 2026 — Joomla's CNA publishes CVE-2026-48908 (CVSS 4.0 10.0, exploitation "attacked").
- Jul 7, 2026 — CISA adds the CVE to KEV with a July 10 federal deadline.
- Jul 10, 2026 — CSA Singapore warns of active exploitation of Joomla page builder extensions.
- Aug 12, 2026 — SP Page Builder 6.8.0 fixes a separate unauthenticated SQL injection.
- Oct 7, 2026 — SP Page Builder 6.10.0, the current release, ships.

## Sources

1. [JoomShaper — Release notes (SP Page Builder 6.6.2 through 6.10.0)](https://www.joomshaper.com/release)
2. [JoomShaper forum — Security Updates (staff: fixed in SP Page Builder v6.6.2)](https://www.joomshaper.com/forum/question/45474)
3. [CVE record — CVE-2026-48908](https://www.cve.org/CVERecord?id=CVE-2026-48908)
4. [NVD — CVE-2026-48908](https://nvd.nist.gov/vuln/detail/CVE-2026-48908)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-48908](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48908)
6. [mySites.guru — CVE-2026-48908: SP Page Builder unauthenticated file upload](https://mysites.guru/vulnerabilities/CVE-2026-48908/)
7. [JoomShaper forum — Security issue still present in SP Page Builder 6.6.2](https://www.joomshaper.com/forum/question/45358)
8. [JoomShaper — SP Page Builder v6.8.0 release](https://www.joomshaper.com/blog/sp-page-builder-v6-8-0)
9. [CSA Singapore — Active exploitation of critical vulnerabilities in Joomla extensions (AL-2026-085)](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-085/)
10. [Beazley Security Labs — BSL-A1187: Joomla page builder extensions exploited](https://labs.beazley.security/advisories/BSL-A1187)
11. [ChronoEngine — Critical zero-day RCE exploit actively targeting SP Page Builder](https://www.chronoengine.com/blog/critical-zero-day-rce-exploit-actively-targeting-sp-page-builder-cve-2026-48908)

---
Source page: https://erroneo.us/security/briefs/sp-page-builder-cve-2026-48908-unauthenticated-upload-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt